Edit tour

Windows Analysis Report
A18OkaGxHz.exe

Overview

General Information

Sample name:	A18OkaGxHz.exe renamed because original name is a hash value
Original sample name:	0241ff0075c6a2192e14cc9e0d040a7f.exe
Analysis ID:	1615985
MD5:	0241ff0075c6a2192e14cc9e0d040a7f
SHA1:	5739466de449cdf70fc4659fcd952dd7da22056c
SHA256:	96ae879d47df27d44d3228a7f6e2050157c7a3fc99ff57293efbf9984afb6701
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

A18OkaGxHz.exe (PID: 5432 cmdline: "C:\Users\user\Desktop\A18OkaGxHz.exe" MD5: 0241FF0075C6A2192E14CC9E0D040A7F)

A18OkaGxHz.exe (PID: 1248 cmdline: "C:\Users\user\Desktop\A18OkaGxHz.exe" MD5: 0241FF0075C6A2192E14CC9E0D040A7F)

conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["45.137.22.234:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x347fa:$a4: get_ScannedWallets 0x4c61a:$a4: get_ScannedWallets 0x33658:$a5: get_ScanTelegram 0x4b478:$a5: get_ScanTelegram 0x3447e:$a6: get_ScanGeckoBrowsersPaths 0x4c29e:$a6: get_ScanGeckoBrowsersPaths 0x3229a:$a7: <Processes>k__BackingField 0x4a0ba:$a7: <Processes>k__BackingField 0x301ac:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x47fcc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x31bce:$a9: <ScanFTP>k__BackingField 0x499ee:$a9: <ScanFTP>k__BackingField
00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x24cffa:$a4: get_ScannedWallets 0x24be58:$a5: get_ScanTelegram 0x24cc7e:$a6: get_ScanGeckoBrowsersPaths 0x24aa9a:$a7: <Processes>k__BackingField 0x2489ac:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x24a3ce:$a9: <ScanFTP>k__BackingField
Process Memory Space: A18OkaGxHz.exe PID: 5432	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: A18OkaGxHz.exe PID: 5432	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: A18OkaGxHz.exe PID: 5432	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: A18OkaGxHz.exe PID: 5432	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x8a40:$a4: get_ScannedWallets 0x805fb:$a4: get_ScannedWallets 0x78e7:$a5: get_ScanTelegram 0x7f6b1:$a5: get_ScanTelegram 0x86c9:$a6: get_ScanGeckoBrowsersPaths 0x802ee:$a6: get_ScanGeckoBrowsersPaths 0x657a:$a7: <Processes>k__BackingField 0x7e590:$a7: <Processes>k__BackingField 0x3aad:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x7bb7f:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5eae:$a9: <ScanFTP>k__BackingField 0x7dec4:$a9: <ScanFTP>k__BackingField
Process Memory Space: A18OkaGxHz.exe PID: 1248	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: A18OkaGxHz.exe PID: 1248	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: A18OkaGxHz.exe PID: 1248	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x68d9:$a4: get_ScannedWallets 0x5780:$a5: get_ScanTelegram 0x6562:$a6: get_ScanGeckoBrowsersPaths 0x4413:$a7: <Processes>k__BackingField 0x1946:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3d47:$a9: <ScanFTP>k__BackingField
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.A18OkaGxHz.exe.3c5a230.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c5a230.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c5a230.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.3c5a230.3.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bd:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.A18OkaGxHz.exe.3c5a230.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.A18OkaGxHz.exe.3c72050.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c72050.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c72050.2.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.3c72050.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bd:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.A18OkaGxHz.exe.3c72050.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
3.2.A18OkaGxHz.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.A18OkaGxHz.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
3.2.A18OkaGxHz.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
3.2.A18OkaGxHz.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.A18OkaGxHz.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x297eb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2981f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29848:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2ba87:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2b003:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b34b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2ac81:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x2846f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x20558:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x20f38:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet
0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x284ab:$v2_2: get_ScanVPN 0x2854e:$v2_2: get_ScanFTP
0.2.A18OkaGxHz.exe.466f810.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.466f810.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.466f810.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x6f7ea:$a4: get_ScannedWallets 0x6e648:$a5: get_ScanTelegram 0x6f46e:$a6: get_ScanGeckoBrowsersPaths 0x6d28a:$a7: <Processes>k__BackingField 0x6b19c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x6cbbe:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.466f810.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x6dbeb:$gen01: ChromeGetRoamingName 0x6dc1f:$gen02: ChromeGetLocalName 0x6dc48:$gen03: get_UserDomainName 0x6fe87:$gen04: get_encrypted_key 0x6f403:$gen05: browserPaths 0x6f74b:$gen06: GetBrowsers 0x6f081:$gen07: get_InstalledInputLanguages 0x6c86f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x64958:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x65338:$spe6: windows-1251, CommandLine: 0x705dd:$spe9: wallet 0x6b02c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0x6b127:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x6b484:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x6b591:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x6b710:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0x6b0b8:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x6b0e1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x6b27f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x6b5ba:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0x6b659:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.A18OkaGxHz.exe.466f810.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x6c6aa:$u7: RunPE 0x6fd61:$u8: DownloadAndEx 0x65350:$pat14: , CommandLine: 0x6f299:$v2_1: ListOfProcesses 0x6c8ab:$v2_2: get_ScanVPN 0x6c94e:$v2_2: get_ScanFTP 0x6d63e:$v2_2: get_ScanDiscord 0x6e62c:$v2_2: get_ScanSteam 0x6e648:$v2_2: get_ScanTelegram 0x6e6ee:$v2_2: get_ScanScreen 0x6f436:$v2_2: get_ScanChromeBrowsersPaths 0x6f46e:$v2_2: get_ScanGeckoBrowsersPaths 0x6f729:$v2_2: get_ScanBrowsers 0x6f7ea:$v2_2: get_ScannedWallets 0x6f810:$v2_2: get_ScanWallets 0x6f830:$v2_3: GetArguments 0x6def9:$v2_4: VerifyUpdate 0x7280a:$v2_4: VerifyUpdate 0x6fbea:$v2_5: VerifyScanRequest 0x6f2e6:$v2_6: GetUpdates 0x727eb:$v2_6: GetUpdates
0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0xcbc0a:$a4: get_ScannedWallets 0xcaa68:$a5: get_ScanTelegram 0xcb88e:$a6: get_ScanGeckoBrowsersPaths 0xc96aa:$a7: <Processes>k__BackingField 0xc75bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xc8fde:$a9: <ScanFTP>k__BackingField
0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xca00b:$gen01: ChromeGetRoamingName 0xca03f:$gen02: ChromeGetLocalName 0xca068:$gen03: get_UserDomainName 0xcc2a7:$gen04: get_encrypted_key 0xcb823:$gen05: browserPaths 0xcbb6b:$gen06: GetBrowsers 0xcb4a1:$gen07: get_InstalledInputLanguages 0xc8c8f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0xc0d78:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0xc1758:$spe6: windows-1251, CommandLine: 0xcc9fd:$spe9: wallet 0xc744c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xc7547:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xc78a4:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xc79b1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xc7b30:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xc74d8:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xc7501:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xc769f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xc79da:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xc7a79:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xc8aca:$u7: RunPE 0xcc181:$u8: DownloadAndEx 0xc1770:$pat14: , CommandLine: 0xcb6b9:$v2_1: ListOfProcesses 0xc8ccb:$v2_2: get_ScanVPN 0xc8d6e:$v2_2: get_ScanFTP 0xc9a5e:$v2_2: get_ScanDiscord 0xcaa4c:$v2_2: get_ScanSteam 0xcaa68:$v2_2: get_ScanTelegram 0xcab0e:$v2_2: get_ScanScreen 0xcb856:$v2_2: get_ScanChromeBrowsersPaths 0xcb88e:$v2_2: get_ScanGeckoBrowsersPaths 0xcbb49:$v2_2: get_ScanBrowsers 0xcbc0a:$v2_2: get_ScannedWallets 0xcbc30:$v2_2: get_ScanWallets 0xcbc50:$v2_3: GetArguments 0xca319:$v2_4: VerifyUpdate 0xcec2a:$v2_4: VerifyUpdate 0xcc00a:$v2_5: VerifyScanRequest 0xcb706:$v2_6: GetUpdates 0xcec0b:$v2_6: GetUpdates
Click to see the 30 entries

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:15.279164+0100	2045000	1	Malware Command and Control Activity Detected	45.137.22.234	55615	192.168.2.5	49706	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:18.553000+0100	2045001	1	Malware Command and Control Activity Detected	45.137.22.234	55615	192.168.2.5	49706	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:10.251653+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49706	45.137.22.234	55615	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:15.474635+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49706	45.137.22.234	55615	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:20.538901+0100	2848200	1	Malware Command and Control Activity Detected	192.168.2.5	49712	45.137.22.234	55615	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:18.611054+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49711	45.137.22.234	55615	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-15T21:01:10.251653+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.5	49706	45.137.22.234	55615	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["45.137.22.234:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for submitted file

Source: A18OkaGxHz.exe	ReversingLabs: Detection: 70%
Source: A18OkaGxHz.exe	Virustotal: Detection: 56%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: A18OkaGxHz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: A18OkaGxHz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.5:49706 -> 45.137.22.234:55615
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49706 -> 45.137.22.234:55615
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.5:49712 -> 45.137.22.234:55615
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49711 -> 45.137.22.234:55615
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 45.137.22.234:55615 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49706 -> 45.137.22.234:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 45.137.22.234:55615 -> 192.168.2.5:49706

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 45.137.22.234:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 45.137.22.234:55615

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.234:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 45.137.22.234:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 45.137.22.234:55615Content-Length: 958598Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 45.137.22.234:55615Content-Length: 958590Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.26.12.31 104.26.12.31

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.5:49710 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.234

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 45.137.22.234:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.234:5
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.234:55615
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.234:55615/
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.234:55615t-
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003110000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003134000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003110000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: A18OkaGxHz.exe	String found in binary or memory: https://api.ipify.orgcoo
Source: A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: A18OkaGxHz.exe PID: 1248, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_050DDC3C	0_2_050DDC3C
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051E6AE8	0_2_051E6AE8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051E0130	0_2_051E0130
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051E0120	0_2_051E0120
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051E6AD8	0_2_051E6AD8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051EF758	0_2_051EF758
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_051EF747	0_2_051EF747
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F859B0	0_2_08F859B0
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F86490	0_2_08F86490
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84718	0_2_08F84718
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F849B0	0_2_08F849B0
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F849A0	0_2_08F849A0
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F859A0	0_2_08F859A0
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F86970	0_2_08F86970
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F86960	0_2_08F86960
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81958	0_2_08F81958
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F8D958	0_2_08F8D958
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81949	0_2_08F81949
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84BF1	0_2_08F84BF1
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81BE8	0_2_08F81BE8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81BD9	0_2_08F81BD9
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84C00	0_2_08F84C00
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F8DD90	0_2_08F8DD90
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81EE8	0_2_08F81EE8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F81ED8	0_2_08F81ED8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84E58	0_2_08F84E58
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84E48	0_2_08F84E48
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F8F198	0_2_08F8F198
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F813B9	0_2_08F813B9
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84378	0_2_08F84378
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F86480	0_2_08F86480
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F80578	0_2_08F80578
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F80568	0_2_08F80568
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F817E8	0_2_08F817E8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F817D8	0_2_08F817D8
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 0_2_08F84707	0_2_08F84707
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_02ECE7B0	3_2_02ECE7B0
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_02ECDC90	3_2_02ECDC90
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_06969630	3_2_06969630
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_06964468	3_2_06964468
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_0696D528	3_2_0696D528
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_06961210	3_2_06961210
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_06963320	3_2_06963320
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Code function: 3_2_0696DA30	3_2_0696DA30

Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000000.00000002.2049506804.0000000007690000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000000.00000002.2040403798.0000000000F9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000000.00000000.2031877912.000000000096A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebcps.exeD vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000000.00000002.2040735535.0000000002E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs A18OkaGxHz.exe
Source: A18OkaGxHz.exe	Binary or memory string: OriginalFilenamebcps.exeD vs A18OkaGxHz.exe

Source: A18OkaGxHz.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: A18OkaGxHz.exe PID: 1248, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: A18OkaGxHz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VTM20xRvZuUaIsisj1.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/45@1/2

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A18OkaGxHz.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_03

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

File created: C:\Users\user\AppData\Local\Temp\tmp795F.tmp

Jump to behavior

Source: A18OkaGxHz.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: A18OkaGxHz.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp99ED.tmp.3.dr, tmp99CC.tmp.3.dr, tmpEE4B.tmp.3.dr, tmp99FE.tmp.3.dr, tmpB45C.tmp.3.dr, tmpB42B.tmp.3.dr, tmp99DD.tmp.3.dr, tmpEE4A.tmp.3.dr, tmpEE2A.tmp.3.dr, tmp99CB.tmp.3.dr, tmp99FF.tmp.3.dr, tmpB42C.tmp.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: A18OkaGxHz.exe	ReversingLabs: Detection: 70%
Source: A18OkaGxHz.exe	Virustotal: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\A18OkaGxHz.exe "C:\Users\user\Desktop\A18OkaGxHz.exe"
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process created: C:\Users\user\Desktop\A18OkaGxHz.exe "C:\Users\user\Desktop\A18OkaGxHz.exe"
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process created: C:\Users\user\Desktop\A18OkaGxHz.exe "C:\Users\user\Desktop\A18OkaGxHz.exe"	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: A18OkaGxHz.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: A18OkaGxHz.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VTM20xRvZuUaIsisj1.cs	.Net Code: pusmkP90bX System.Reflection.Assembly.Load(byte[])
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VTM20xRvZuUaIsisj1.cs	.Net Code: pusmkP90bX System.Reflection.Assembly.Load(byte[])
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VTM20xRvZuUaIsisj1.cs	.Net Code: pusmkP90bX System.Reflection.Assembly.Load(byte[])

Source: A18OkaGxHz.exe

Static PE information: section name: .text entropy: 7.739248657853289

Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, FF8fbhNe8Fxelfln3G.cs	High entropy of concatenated method names: 'dDEkPrkwM', 'X4TcdhZjT', 'GL5TJKFfw', 'WFfOoThjt', 'vHuSmAIjC', 'Yy0CkV3MB', 'rWRo1qGRBLWBhGa5DG', 'UoMkfRjsITeCfk30AV', 'lC9D2pofM', 'mcSrCTk0S'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	High entropy of concatenated method names: 'v4y0LkL6AE', 'q8R0H9PtlK', 'JZc0FriVij', 'c2s0sfP3p9', 'len0wwuyRk', 'a360IogW7X', 'SRS0eXGNaA', 'T5S0i7xMMJ', 'xZx0Jn7Kn4', 'Qpi0MaMiAZ'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VTM20xRvZuUaIsisj1.cs	High entropy of concatenated method names: 'owrgoy1BOV', 'FpggQcC8L7', 'n9fg0rZeMd', 'ymGgn1DT4r', 'gTsgWuKAy2', 'fTHgUWrxHY', 'JZxg9cImSB', 'LjPgRNkd8A', 'HUJgyN98LU', 'rV5g212ipM'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, HjGgoTFl9Kh7xjJqUO.cs	High entropy of concatenated method names: 'ToString', 'ulxVbmpZf0', 'FiEVvTnDfF', 'uHKVdewNX9', 'LCsVKqYY3u', 'A7lV8JBueA', 'b5PV79a3qe', 'sdTV3iyift', 'jilVAxyDci', 'CDOV4EXNNc'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, NvxxnEvEY37MZTSAd8.cs	High entropy of concatenated method names: 'w8oyfhCtiD5UiWVr86y', 'e22JEmC7rHx2CnHAP5D', 'NOuUDplMaq', 'kGDUByuH0g', 'lWyUr1Y4oJ', 'T5qLKjCqPwAsRwbZ12E', 'QkumHGCHK8N9tyxFPLe'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, u30fxn38SPD23Nt0vo.cs	High entropy of concatenated method names: 'ncX9Qu1VEK', 'rXU9nJGL5M', 'TgC9UyRKDA', 'c9hUMYbYPv', 'GJ9UzAp3EB', 'Vsc91roBtR', 'Axi9Y9F3d6', 'BrF9NiPUCH', 'Dkj9g5LoSJ', 'YDW9mqgn6k'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, eNfW4CLlXaQFqEuwbo.cs	High entropy of concatenated method names: 'KS8lj2BgOQ', 'tuqlGPCCr2', 'JrmlLjgTZc', 'IPPlHXylqA', 'C81lvUeGNo', 'Gl9ldMsuY2', 'kJvlK0q9vh', 'DyZl8wKjHX', 'SEgl7pOZKN', 'rq2l37tY6A'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, dVbXEvYm4DY0yvESA1o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ws0XBHCqEA', 'Y16XrtWBli', 'r5BX68hhyp', 'jdiXXrhgre', 'vu6X5lPX83', 'mJYXt82LLZ', 'gCIXaP4PPc'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, z7EYOlzQIJnPUGRERg.cs	High entropy of concatenated method names: 'Uu3rTSkCwP', 't2DrPpJTTD', 'qhprSgq30r', 'cf7rpTm3u1', 'OJXrv9xNpq', 'GudrKJ4579', 'Gr6r8TU7ZA', 'wLgraKXdWO', 'YlNrZnppId', 'aujru71BOX'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, JsoyV7IEVFWfRdmxkm.cs	High entropy of concatenated method names: 'f8lqiCtjah', 'fg4qM5mXaq', 'pr0D1R0Kga', 'ynaDYbjqJX', 'qnAqbciLx0', 'PYJqGEQ0Ie', 'j9tqf2rXgL', 'O6nqLxG3am', 'Jv9qHfbE3E', 'tCtqFfgcWo'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, yLfAMmCc02SSi5ktP5.cs	High entropy of concatenated method names: 'DZ9WEcLZFT', 'AcjWOqc6jY', 'qhnnde2Tfv', 'bJ3nKAjdRA', 'B6xn8R5Dow', 't3Kn7iK7hw', 'KJ0n3JnXEM', 't3PnAM1Q7A', 'Uccn4Mv4rU', 'F9Inj79u16'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, NERafV4OBuh2oj0goU.cs	High entropy of concatenated method names: 'lu19Zq4vgP', 'V2A9uRZKwC', 'BoP9kWaULi', 'mUf9ckNKkq', 'PLb9E6sd4W', 'T8o9TskL2p', 'nG99Owd8Nb', 'oUc9PjJxSs', 'CGF9SImPRp', 'xAi9Ck7NuA'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, zP6O3C0rEgKNb2PlvX.cs	High entropy of concatenated method names: 'Dispose', 'njmYJOuqj6', 'NVONvvmKaD', 'gwihns96Vs', 'vqNYMNsK8h', 'OxRYzju9N9', 'ProcessDialogKey', 'BmPN1C6d1j', 'qfXNYb4AGY', 'uiINNIly8f'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, mKiLyrp1aFXdlqrwUS.cs	High entropy of concatenated method names: 'gT5UoTNad8', 'uVqU05d1BC', 'OaSUWkHpO3', 'zXEU9oB7F7', 'qmHURAjSVG', 'j1vWwdwZSl', 'P9eWIMKBo9', 'MVEWe8SvWD', 'HnEWipWcxT', 'iPdWJWOQ9F'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, DC6d1jJqfXb4AGYXiI.cs	High entropy of concatenated method names: 'mPmBpHvKmk', 'xoVBvAtark', 'kUVBdWsAyr', 'qbiBKvvbgP', 'z4mB8Ip0Hw', 'z0cB7HcNiE', 'joBB3YxPax', 'V2DBAg1rdy', 'YBDB4GoOen', 'QbjBjL9bkg'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, ao1rYRfodfPmP7GLOt.cs	High entropy of concatenated method names: 'TmlxPoQBvK', 'PQPxS2shDs', 'ADLxpNQoyX', 'KycxvS7UAi', 'srmxK7V7Er', 'bRUx8id94T', 'Nnxx3Wngoi', 'RyhxAbC0Og', 'kyyxjrtwiQ', 'IiexbbOCv3'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, lma0KnnqFTD7DEgYIl.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zNjNJ5w8rZ', 'V6CNMaH6OH', 'nUPNzJekR9', 'jxCg19M5HK', 'lTPgYqtqPj', 'GhegNKVt7B', 'r9Lggan1RB', 'mWG5pVVsQcCUXQ9vw7E'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, YlmxAqSY78WSZmOAw2.cs	High entropy of concatenated method names: 'fjjnc040Vy', 'NO1nTXa9Ef', 'UCknPjRQqy', 'flenSSl4bu', 'xoPnlE5NLs', 'tdfnVM4Ify', 'aBVnqltQkh', 'bJSnDHo60s', 'eicnB4awJe', 'Glunr5eWKm'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, naEHEkYYnxRhgqUJ3Mn.cs	High entropy of concatenated method names: 'zRirMBlXXd', 'mQHrz9CuIR', 'WlQ611derB', 'ROd6YDT2Zr', 'Y026NSp7gR', 'Sx56gihbHv', 'MYF6m5CcSN', 'peG6oZwLXk', 'Ec26QknWiE', 'OAP60eosZu'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, VO4CkJebShjmOuqj6t.cs	High entropy of concatenated method names: 'aPPBl7rcne', 'FNvBqcR3tX', 'jB3BBh4uPu', 'oj9B6XQvqN', 'x2sB53qDdZ', 'v4UBanl8XG', 'Dispose', 'jFIDQbUlk9', 'Rl1D0kCwtZ', 'FnaDnLRJDv'
Source: 0.2.A18OkaGxHz.exe.7690000.5.raw.unpack, kxqcUUmUNbKvrW7K9D.cs	High entropy of concatenated method names: 'daZY9wHxWK', 'UO3YRpBPhU', 'qY7Y28WSZm', 'CAwYh2ZLfA', 'uktYlP5hKi', 'RyrYV1aFXd', 'wi83gRXdLSt6niNsYL', 'loHxn6wiKxEIU5SouD', 'w3hYYDfxnS', 'YcIYgZrMgI'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, FF8fbhNe8Fxelfln3G.cs	High entropy of concatenated method names: 'dDEkPrkwM', 'X4TcdhZjT', 'GL5TJKFfw', 'WFfOoThjt', 'vHuSmAIjC', 'Yy0CkV3MB', 'rWRo1qGRBLWBhGa5DG', 'UoMkfRjsITeCfk30AV', 'lC9D2pofM', 'mcSrCTk0S'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	High entropy of concatenated method names: 'v4y0LkL6AE', 'q8R0H9PtlK', 'JZc0FriVij', 'c2s0sfP3p9', 'len0wwuyRk', 'a360IogW7X', 'SRS0eXGNaA', 'T5S0i7xMMJ', 'xZx0Jn7Kn4', 'Qpi0MaMiAZ'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VTM20xRvZuUaIsisj1.cs	High entropy of concatenated method names: 'owrgoy1BOV', 'FpggQcC8L7', 'n9fg0rZeMd', 'ymGgn1DT4r', 'gTsgWuKAy2', 'fTHgUWrxHY', 'JZxg9cImSB', 'LjPgRNkd8A', 'HUJgyN98LU', 'rV5g212ipM'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, HjGgoTFl9Kh7xjJqUO.cs	High entropy of concatenated method names: 'ToString', 'ulxVbmpZf0', 'FiEVvTnDfF', 'uHKVdewNX9', 'LCsVKqYY3u', 'A7lV8JBueA', 'b5PV79a3qe', 'sdTV3iyift', 'jilVAxyDci', 'CDOV4EXNNc'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, NvxxnEvEY37MZTSAd8.cs	High entropy of concatenated method names: 'w8oyfhCtiD5UiWVr86y', 'e22JEmC7rHx2CnHAP5D', 'NOuUDplMaq', 'kGDUByuH0g', 'lWyUr1Y4oJ', 'T5qLKjCqPwAsRwbZ12E', 'QkumHGCHK8N9tyxFPLe'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, u30fxn38SPD23Nt0vo.cs	High entropy of concatenated method names: 'ncX9Qu1VEK', 'rXU9nJGL5M', 'TgC9UyRKDA', 'c9hUMYbYPv', 'GJ9UzAp3EB', 'Vsc91roBtR', 'Axi9Y9F3d6', 'BrF9NiPUCH', 'Dkj9g5LoSJ', 'YDW9mqgn6k'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, eNfW4CLlXaQFqEuwbo.cs	High entropy of concatenated method names: 'KS8lj2BgOQ', 'tuqlGPCCr2', 'JrmlLjgTZc', 'IPPlHXylqA', 'C81lvUeGNo', 'Gl9ldMsuY2', 'kJvlK0q9vh', 'DyZl8wKjHX', 'SEgl7pOZKN', 'rq2l37tY6A'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, dVbXEvYm4DY0yvESA1o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ws0XBHCqEA', 'Y16XrtWBli', 'r5BX68hhyp', 'jdiXXrhgre', 'vu6X5lPX83', 'mJYXt82LLZ', 'gCIXaP4PPc'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, z7EYOlzQIJnPUGRERg.cs	High entropy of concatenated method names: 'Uu3rTSkCwP', 't2DrPpJTTD', 'qhprSgq30r', 'cf7rpTm3u1', 'OJXrv9xNpq', 'GudrKJ4579', 'Gr6r8TU7ZA', 'wLgraKXdWO', 'YlNrZnppId', 'aujru71BOX'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, JsoyV7IEVFWfRdmxkm.cs	High entropy of concatenated method names: 'f8lqiCtjah', 'fg4qM5mXaq', 'pr0D1R0Kga', 'ynaDYbjqJX', 'qnAqbciLx0', 'PYJqGEQ0Ie', 'j9tqf2rXgL', 'O6nqLxG3am', 'Jv9qHfbE3E', 'tCtqFfgcWo'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, yLfAMmCc02SSi5ktP5.cs	High entropy of concatenated method names: 'DZ9WEcLZFT', 'AcjWOqc6jY', 'qhnnde2Tfv', 'bJ3nKAjdRA', 'B6xn8R5Dow', 't3Kn7iK7hw', 'KJ0n3JnXEM', 't3PnAM1Q7A', 'Uccn4Mv4rU', 'F9Inj79u16'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, NERafV4OBuh2oj0goU.cs	High entropy of concatenated method names: 'lu19Zq4vgP', 'V2A9uRZKwC', 'BoP9kWaULi', 'mUf9ckNKkq', 'PLb9E6sd4W', 'T8o9TskL2p', 'nG99Owd8Nb', 'oUc9PjJxSs', 'CGF9SImPRp', 'xAi9Ck7NuA'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, zP6O3C0rEgKNb2PlvX.cs	High entropy of concatenated method names: 'Dispose', 'njmYJOuqj6', 'NVONvvmKaD', 'gwihns96Vs', 'vqNYMNsK8h', 'OxRYzju9N9', 'ProcessDialogKey', 'BmPN1C6d1j', 'qfXNYb4AGY', 'uiINNIly8f'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, mKiLyrp1aFXdlqrwUS.cs	High entropy of concatenated method names: 'gT5UoTNad8', 'uVqU05d1BC', 'OaSUWkHpO3', 'zXEU9oB7F7', 'qmHURAjSVG', 'j1vWwdwZSl', 'P9eWIMKBo9', 'MVEWe8SvWD', 'HnEWipWcxT', 'iPdWJWOQ9F'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, DC6d1jJqfXb4AGYXiI.cs	High entropy of concatenated method names: 'mPmBpHvKmk', 'xoVBvAtark', 'kUVBdWsAyr', 'qbiBKvvbgP', 'z4mB8Ip0Hw', 'z0cB7HcNiE', 'joBB3YxPax', 'V2DBAg1rdy', 'YBDB4GoOen', 'QbjBjL9bkg'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, ao1rYRfodfPmP7GLOt.cs	High entropy of concatenated method names: 'TmlxPoQBvK', 'PQPxS2shDs', 'ADLxpNQoyX', 'KycxvS7UAi', 'srmxK7V7Er', 'bRUx8id94T', 'Nnxx3Wngoi', 'RyhxAbC0Og', 'kyyxjrtwiQ', 'IiexbbOCv3'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, lma0KnnqFTD7DEgYIl.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zNjNJ5w8rZ', 'V6CNMaH6OH', 'nUPNzJekR9', 'jxCg19M5HK', 'lTPgYqtqPj', 'GhegNKVt7B', 'r9Lggan1RB', 'mWG5pVVsQcCUXQ9vw7E'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, YlmxAqSY78WSZmOAw2.cs	High entropy of concatenated method names: 'fjjnc040Vy', 'NO1nTXa9Ef', 'UCknPjRQqy', 'flenSSl4bu', 'xoPnlE5NLs', 'tdfnVM4Ify', 'aBVnqltQkh', 'bJSnDHo60s', 'eicnB4awJe', 'Glunr5eWKm'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, naEHEkYYnxRhgqUJ3Mn.cs	High entropy of concatenated method names: 'zRirMBlXXd', 'mQHrz9CuIR', 'WlQ611derB', 'ROd6YDT2Zr', 'Y026NSp7gR', 'Sx56gihbHv', 'MYF6m5CcSN', 'peG6oZwLXk', 'Ec26QknWiE', 'OAP60eosZu'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, VO4CkJebShjmOuqj6t.cs	High entropy of concatenated method names: 'aPPBl7rcne', 'FNvBqcR3tX', 'jB3BBh4uPu', 'oj9B6XQvqN', 'x2sB53qDdZ', 'v4UBanl8XG', 'Dispose', 'jFIDQbUlk9', 'Rl1D0kCwtZ', 'FnaDnLRJDv'
Source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, kxqcUUmUNbKvrW7K9D.cs	High entropy of concatenated method names: 'daZY9wHxWK', 'UO3YRpBPhU', 'qY7Y28WSZm', 'CAwYh2ZLfA', 'uktYlP5hKi', 'RyrYV1aFXd', 'wi83gRXdLSt6niNsYL', 'loHxn6wiKxEIU5SouD', 'w3hYYDfxnS', 'YcIYgZrMgI'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, FF8fbhNe8Fxelfln3G.cs	High entropy of concatenated method names: 'dDEkPrkwM', 'X4TcdhZjT', 'GL5TJKFfw', 'WFfOoThjt', 'vHuSmAIjC', 'Yy0CkV3MB', 'rWRo1qGRBLWBhGa5DG', 'UoMkfRjsITeCfk30AV', 'lC9D2pofM', 'mcSrCTk0S'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, xwHxWKPwO3pBPhUkbl.cs	High entropy of concatenated method names: 'v4y0LkL6AE', 'q8R0H9PtlK', 'JZc0FriVij', 'c2s0sfP3p9', 'len0wwuyRk', 'a360IogW7X', 'SRS0eXGNaA', 'T5S0i7xMMJ', 'xZx0Jn7Kn4', 'Qpi0MaMiAZ'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VTM20xRvZuUaIsisj1.cs	High entropy of concatenated method names: 'owrgoy1BOV', 'FpggQcC8L7', 'n9fg0rZeMd', 'ymGgn1DT4r', 'gTsgWuKAy2', 'fTHgUWrxHY', 'JZxg9cImSB', 'LjPgRNkd8A', 'HUJgyN98LU', 'rV5g212ipM'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, HjGgoTFl9Kh7xjJqUO.cs	High entropy of concatenated method names: 'ToString', 'ulxVbmpZf0', 'FiEVvTnDfF', 'uHKVdewNX9', 'LCsVKqYY3u', 'A7lV8JBueA', 'b5PV79a3qe', 'sdTV3iyift', 'jilVAxyDci', 'CDOV4EXNNc'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, NvxxnEvEY37MZTSAd8.cs	High entropy of concatenated method names: 'w8oyfhCtiD5UiWVr86y', 'e22JEmC7rHx2CnHAP5D', 'NOuUDplMaq', 'kGDUByuH0g', 'lWyUr1Y4oJ', 'T5qLKjCqPwAsRwbZ12E', 'QkumHGCHK8N9tyxFPLe'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, u30fxn38SPD23Nt0vo.cs	High entropy of concatenated method names: 'ncX9Qu1VEK', 'rXU9nJGL5M', 'TgC9UyRKDA', 'c9hUMYbYPv', 'GJ9UzAp3EB', 'Vsc91roBtR', 'Axi9Y9F3d6', 'BrF9NiPUCH', 'Dkj9g5LoSJ', 'YDW9mqgn6k'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, eNfW4CLlXaQFqEuwbo.cs	High entropy of concatenated method names: 'KS8lj2BgOQ', 'tuqlGPCCr2', 'JrmlLjgTZc', 'IPPlHXylqA', 'C81lvUeGNo', 'Gl9ldMsuY2', 'kJvlK0q9vh', 'DyZl8wKjHX', 'SEgl7pOZKN', 'rq2l37tY6A'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, dVbXEvYm4DY0yvESA1o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ws0XBHCqEA', 'Y16XrtWBli', 'r5BX68hhyp', 'jdiXXrhgre', 'vu6X5lPX83', 'mJYXt82LLZ', 'gCIXaP4PPc'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, z7EYOlzQIJnPUGRERg.cs	High entropy of concatenated method names: 'Uu3rTSkCwP', 't2DrPpJTTD', 'qhprSgq30r', 'cf7rpTm3u1', 'OJXrv9xNpq', 'GudrKJ4579', 'Gr6r8TU7ZA', 'wLgraKXdWO', 'YlNrZnppId', 'aujru71BOX'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, JsoyV7IEVFWfRdmxkm.cs	High entropy of concatenated method names: 'f8lqiCtjah', 'fg4qM5mXaq', 'pr0D1R0Kga', 'ynaDYbjqJX', 'qnAqbciLx0', 'PYJqGEQ0Ie', 'j9tqf2rXgL', 'O6nqLxG3am', 'Jv9qHfbE3E', 'tCtqFfgcWo'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, yLfAMmCc02SSi5ktP5.cs	High entropy of concatenated method names: 'DZ9WEcLZFT', 'AcjWOqc6jY', 'qhnnde2Tfv', 'bJ3nKAjdRA', 'B6xn8R5Dow', 't3Kn7iK7hw', 'KJ0n3JnXEM', 't3PnAM1Q7A', 'Uccn4Mv4rU', 'F9Inj79u16'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, NERafV4OBuh2oj0goU.cs	High entropy of concatenated method names: 'lu19Zq4vgP', 'V2A9uRZKwC', 'BoP9kWaULi', 'mUf9ckNKkq', 'PLb9E6sd4W', 'T8o9TskL2p', 'nG99Owd8Nb', 'oUc9PjJxSs', 'CGF9SImPRp', 'xAi9Ck7NuA'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, zP6O3C0rEgKNb2PlvX.cs	High entropy of concatenated method names: 'Dispose', 'njmYJOuqj6', 'NVONvvmKaD', 'gwihns96Vs', 'vqNYMNsK8h', 'OxRYzju9N9', 'ProcessDialogKey', 'BmPN1C6d1j', 'qfXNYb4AGY', 'uiINNIly8f'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, mKiLyrp1aFXdlqrwUS.cs	High entropy of concatenated method names: 'gT5UoTNad8', 'uVqU05d1BC', 'OaSUWkHpO3', 'zXEU9oB7F7', 'qmHURAjSVG', 'j1vWwdwZSl', 'P9eWIMKBo9', 'MVEWe8SvWD', 'HnEWipWcxT', 'iPdWJWOQ9F'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, DC6d1jJqfXb4AGYXiI.cs	High entropy of concatenated method names: 'mPmBpHvKmk', 'xoVBvAtark', 'kUVBdWsAyr', 'qbiBKvvbgP', 'z4mB8Ip0Hw', 'z0cB7HcNiE', 'joBB3YxPax', 'V2DBAg1rdy', 'YBDB4GoOen', 'QbjBjL9bkg'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, ao1rYRfodfPmP7GLOt.cs	High entropy of concatenated method names: 'TmlxPoQBvK', 'PQPxS2shDs', 'ADLxpNQoyX', 'KycxvS7UAi', 'srmxK7V7Er', 'bRUx8id94T', 'Nnxx3Wngoi', 'RyhxAbC0Og', 'kyyxjrtwiQ', 'IiexbbOCv3'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, lma0KnnqFTD7DEgYIl.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'zNjNJ5w8rZ', 'V6CNMaH6OH', 'nUPNzJekR9', 'jxCg19M5HK', 'lTPgYqtqPj', 'GhegNKVt7B', 'r9Lggan1RB', 'mWG5pVVsQcCUXQ9vw7E'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, YlmxAqSY78WSZmOAw2.cs	High entropy of concatenated method names: 'fjjnc040Vy', 'NO1nTXa9Ef', 'UCknPjRQqy', 'flenSSl4bu', 'xoPnlE5NLs', 'tdfnVM4Ify', 'aBVnqltQkh', 'bJSnDHo60s', 'eicnB4awJe', 'Glunr5eWKm'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, naEHEkYYnxRhgqUJ3Mn.cs	High entropy of concatenated method names: 'zRirMBlXXd', 'mQHrz9CuIR', 'WlQ611derB', 'ROd6YDT2Zr', 'Y026NSp7gR', 'Sx56gihbHv', 'MYF6m5CcSN', 'peG6oZwLXk', 'Ec26QknWiE', 'OAP60eosZu'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, VO4CkJebShjmOuqj6t.cs	High entropy of concatenated method names: 'aPPBl7rcne', 'FNvBqcR3tX', 'jB3BBh4uPu', 'oj9B6XQvqN', 'x2sB53qDdZ', 'v4UBanl8XG', 'Dispose', 'jFIDQbUlk9', 'Rl1D0kCwtZ', 'FnaDnLRJDv'
Source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, kxqcUUmUNbKvrW7K9D.cs	High entropy of concatenated method names: 'daZY9wHxWK', 'UO3YRpBPhU', 'qY7Y28WSZm', 'CAwYh2ZLfA', 'uktYlP5hKi', 'RyrYV1aFXd', 'wi83gRXdLSt6niNsYL', 'loHxn6wiKxEIU5SouD', 'w3hYYDfxnS', 'YcIYgZrMgI'

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49712

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 2C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 7DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 8DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 8F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 9F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: A440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: B440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: C440000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 2E80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Window / User API: threadDelayed 1970			Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Window / User API: threadDelayed 5679			Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe TID: 6004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe TID: 6600	Thread sleep time: -24903104499507879s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe TID: 2792	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe TID: 6416	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: tmpD24D.tmp.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: A18OkaGxHz.exe, 00000003.00000002.2170303626.0000000001264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZ
Source: tmpD24D.tmp.3.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmpD24D.tmp.3.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmpD24D.tmp.3.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: tmpD24D.tmp.3.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmpD24D.tmp.3.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmpD24D.tmp.3.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmpD24D.tmp.3.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: tmpD24D.tmp.3.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpD24D.tmp.3.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmpD24D.tmp.3.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmpD24D.tmp.3.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmpD24D.tmp.3.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmpD24D.tmp.3.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: tmpD24D.tmp.3.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: tmpD24D.tmp.3.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmpD24D.tmp.3.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmpD24D.tmp.3.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Process created: C:\Users\user\Desktop\A18OkaGxHz.exe "C:\Users\user\Desktop\A18OkaGxHz.exe"

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Users\user\Desktop\A18OkaGxHz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Users\user\Desktop\A18OkaGxHz.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 1248, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: A18OkaGxHz.exe, 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $]q6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\A18OkaGxHz.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 1248, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c72050.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.A18OkaGxHz.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.3c5a230.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.466f810.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.A18OkaGxHz.exe.46133f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: A18OkaGxHz.exe PID: 1248, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
A18OkaGxHz.exe	70%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
A18OkaGxHz.exe	57%	Virustotal		Browse

Source	Detection	Scanner	Label
http://45.137.22.234:55615/	0%	Avira URL Cloud	safe
http://45.137.22.234:55615t-	0%	Avira URL Cloud	safe
45.137.22.234:55615	0%	Avira URL Cloud	safe
http://45.137.22.234:5	0%	Avira URL Cloud	safe
http://45.137.22.234:55615	0%	Avira URL Cloud	safe
https://api.ipify.orgcoo	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	104.26.12.31	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://45.137.22.234:55615/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
45.137.22.234:55615	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
https://duckduckgo.com/ac/?q=	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
http://45.137.22.234:55615	A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ip.sb	A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003110000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
http://tempuri.org/	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
https://www.ecosia.org/newtab/	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnviron	A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003110000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003134000.00000004.00000800.00020000.00000000.sdmp, A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
http://45.137.22.234:55615t-	A18OkaGxHz.exe, 00000003.00000002.2171826538.000000000313C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	A18OkaGxHz.exe, A18OkaGxHz.exe, 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.137.22.234:5	A18OkaGxHz.exe, 00000003.00000002.2171826538.0000000003258000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpEE8D.tmp.3.dr, tmp27EE.tmp.3.dr, tmp280F.tmp.3.dr, tmp27DE.tmp.3.dr, tmpEE7C.tmp.3.dr, tmp6123.tmp.3.dr, tmp283F.tmp.3.dr, tmp6134.tmp.3.dr, tmp6154.tmp.3.dr, tmpEE6C.tmp.3.dr, tmp6103.tmp.3.dr, tmp6165.tmp.3.dr	false		high
https://api.ipify.orgcoo	A18OkaGxHz.exe	true	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	A18OkaGxHz.exe, 00000003.00000002.2171826538.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
45.137.22.234	unknown	Netherlands		51447	ROOTLAYERNETNL	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1615985
Start date and time:	2025-02-15 21:00:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	A18OkaGxHz.exe renamed because original name is a hash value
Original Sample Name:	0241ff0075c6a2192e14cc9e0d040a7f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/45@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 51 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.19.106.160, 13.107.246.45, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:01:07	API Interceptor	41x Sleep call for process: A18OkaGxHz.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.31	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	nePPsHIZ1m.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	CxfUzjqyxz.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	1w5RpHuliE.exe	Get hash	malicious	Amadey, GCleaner, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Vidar	Browse	172.67.75.172
	SecuriteInfo.com.Win32.Evo-gen.12305.7160.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	rH3TpuMpZn.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, PureLog Stealer, Quasar, RedLine, Vidar	Browse	104.26.12.31
	Ryay9q4aDy.exe	Get hash	malicious	ScreenConnect Tool, Amadey, LummaC Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	random.exe	Get hash	malicious	Amadey, Credential Flusher, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer, RedLine	Browse	104.26.13.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, Vidar, XWorm, Xmrig	Browse	104.26.13.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Paketfoto_pdf.vbs	Get hash	malicious	XWorm	Browse	104.21.78.7
	https://u40362724.ct.sendgrid.net/ls/click?upn=u001.AIAIIgsR9DYpfnDcYDDcB-2FH04-2Bw15hWv-2FQG9f9GyYMxoYZI0EMTcIFGlnLUMJaeXWfQkso8L0Pg22-2BN8Dl4SKkuGQK4LTBd6SrqGD16fuglHjKig9IdCQX6kMIoCbc3imWzJ6J5j-2FI5R1ZDT-2B3iVLs5XrdQdThvrNWcCC8-2BXszs-3DKCL7_KLIoTjFO40Z9pcySq7dJvP-2F4O0bxgkCEKrPbe9NcB9Lnt29GChfkzS40U4uEPnofQsSlowwfYWZWBouhSAGJhhutvfyEjm-2BohUBd9188ex3rH7ZinpIlHQnKRLKcL-2BuAMKPlmABiKh2Tl-2BWQVbtTYLLXzrZM1krN4q6Oas8IZF3K-2FKbiIWoKNYJ7gqMqxovcHmf5LD0qaDj1zFO-2BleUBdSw3rWLCtQW4Pj3WQVw-2Bx60-3D	Get hash	malicious	Unknown	Browse	104.16.2.189
	UPIlkrNpsh.exe	Get hash	malicious	Unknown	Browse	104.21.64.1
	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	H3Ze9Uj.exe	Get hash	malicious	XWorm	Browse	104.21.1.182
	spoDnGT.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.23.62
	kzTq7Bt.exe	Get hash	malicious	Unknown	Browse	104.21.2.178
	GWZ8arC.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.23.85
	random.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer	Browse	104.21.23.62
	fp76Xtt.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.65.45
ROOTLAYERNETNL	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	185.222.58.36
	nePPsHIZ1m.exe	Get hash	malicious	RedLine	Browse	45.137.22.165
	3WSFIhTu1M.exe	Get hash	malicious	RedLine	Browse	185.222.58.254
	qJ64p5G1XJ.exe	Get hash	malicious	RedLine	Browse	45.137.22.227
	chTJmCR9bS.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.222.57.84
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	185.222.57.67
	p0GiAimtNm.exe	Get hash	malicious	RedLine	Browse	185.222.58.237
	nzLoHpgAln.exe	Get hash	malicious	RedLine	Browse	185.222.57.76
	ljMiHZ8MwZ.exe	Get hash	malicious	RedLine	Browse	45.137.22.250
	aYf5ibGObB.exe	Get hash	malicious	RedLine	Browse	185.222.58.90

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	LEC3KQZZqZ	Get hash	malicious	Unknown	Browse	104.26.12.31
	FGfFsID8ug.exe	Get hash	malicious	Unknown	Browse	104.26.12.31
	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	Justificante67ab404ffe31b359e00a499e656454545.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.26.12.31
	PO1302202500018273645.exe	Get hash	malicious	GuLoader	Browse	104.26.12.31
	000999374847565342.exe	Get hash	malicious	GuLoader	Browse	104.26.12.31
	nePPsHIZ1m.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	SPECIFICATIONS112025.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.12.31
	T506-21120.exe	Get hash	malicious	MassLogger RAT	Browse	104.26.12.31
	130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.31

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\tmp27DE.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp27EE.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp280F.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp283F.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6103.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6123.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6134.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6154.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6165.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp795F.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmp796F.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmp7970.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp7971.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\Users\user\AppData\Local\Temp\tmp7982.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\Local\Temp\tmp7983.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\Users\user\AppData\Local\Temp\tmp99CB.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99CC.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99DD.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99ED.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99FE.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp99FF.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9A10.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9A20.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9A31.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9DB.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9EC.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9FC.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA0D.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB42B.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB42C.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB45C.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD20B.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD21B.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD22C.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD23D.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD24D.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD25E.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD26E.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE2A.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE4A.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE4B.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE6C.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE7C.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpEE8D.tmp

Download File

Process:	C:\Users\user\Desktop\A18OkaGxHz.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.733929553998451
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	A18OkaGxHz.exe
File size:	689'664 bytes
MD5:	0241ff0075c6a2192e14cc9e0d040a7f
SHA1:	5739466de449cdf70fc4659fcd952dd7da22056c
SHA256:	96ae879d47df27d44d3228a7f6e2050157c7a3fc99ff57293efbf9984afb6701
SHA512:	2f65a99da569096b7f88514b841ce53d78852867062d87c1275cabf5c87891307ab624470037ce57b7dfd217293f8505f387dae57e46d17f9cdf30e21767a951
SSDEEP:	12288:1KvVY6ao4/7xefpM4+2tdtzwXN0tt5YtiT/lxNU7fi44KhpQnES5BAL+o63RY/:4vVJutehM2tPwstTxxNUn48QnKyo6BY/
TLSH:	7CE4E0D43B26A71ACE692530CA31EDF552A81DACB500B9E36EDD3F5B79AC101AD0CF41
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0..h............... ........@.. ....................................`................................

File Icon


Icon Hash:	1bb3b3b3b3d389b3

Static PE Info

General

Entrypoint:	0x4a861a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67AC12D5 [Wed Feb 12 03:17:41 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa85c8	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x19a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa6620	0xa6800	f858f5610a79385847388b1ee15fe6e0	False	0.9044508375563063	data	7.739248657853289	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x19a0	0x1a00	94b4560a8a81ad4a7a1cd1b6b3cdb661	False	0.7932692307692307	data	7.185667246477439	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	ab44d1d669484b01f004c0a9d3291fc5	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa118	0x151a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8863383931877082
RT_GROUP_ICON	0xab634	0x14	data	0.9
RT_GROUP_ICON	0xab648	0x14	data	1.05
RT_VERSION	0xab65c	0x342	data	0.4244604316546763

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	Baking Management
CompanyName	Microsoft
FileDescription
FileVersion	36.1.0.0
InternalName	bcps.exe
LegalCopyright	Microsoft 2025
LegalTrademarks
OriginalFilename	bcps.exe
ProductName	Baking Management
ProductVersion	36.1.0.0
Assembly Version	36.1.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-15T21:01:10.251653+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.5	49706	45.137.22.234	55615	TCP
2025-02-15T21:01:10.251653+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49706	45.137.22.234	55615	TCP
2025-02-15T21:01:15.279164+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	45.137.22.234	55615	192.168.2.5	49706	TCP
2025-02-15T21:01:15.474635+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49706	45.137.22.234	55615	TCP
2025-02-15T21:01:18.553000+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	45.137.22.234	55615	192.168.2.5	49706	TCP
2025-02-15T21:01:18.611054+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49711	45.137.22.234	55615	TCP
2025-02-15T21:01:20.538901+0100	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.5	49712	45.137.22.234	55615	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 21:01:09.586038113 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:09.590950966 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:09.591730118 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:09.609738111 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:09.614550114 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:09.957545996 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:09.962519884 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:10.199235916 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:10.251652956 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.274065018 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.274162054 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.279164076 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.279383898 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474322081 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474472046 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474483013 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474493980 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474504948 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.474634886 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.517313957 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.550904036 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.550924063 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.551012039 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.551012993 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.551024914 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.551089048 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.551176071 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:15.595424891 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:15.983706951 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:15.983737946 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:15.983795881 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:15.988832951 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:15.988843918 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.456665039 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.456754923 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:16.462460995 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:16.462475061 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.462930918 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.517270088 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:16.518943071 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:16.559334993 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.890285969 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.890496016 CET	443	49710	104.26.12.31	192.168.2.5
Feb 15, 2025 21:01:16.890566111 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:16.893410921 CET	49710	443	192.168.2.5	104.26.12.31
Feb 15, 2025 21:01:18.548073053 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.548429966 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.552999973 CET	55615	49706	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.553065062 CET	49706	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.553208113 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.553278923 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.553992033 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.554229021 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.558775902 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.558998108 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559030056 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559036016 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559036016 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559083939 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559111118 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559118986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559159040 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559190035 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559197903 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559241056 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559324980 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559338093 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559389114 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.559415102 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.559457064 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.563860893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.563869953 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.563900948 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.563909054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.563927889 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.563963890 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.563967943 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.563976049 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.564044952 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.610816956 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.611053944 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.658833981 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.658895016 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.706809044 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.706878901 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.754766941 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.754834890 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.806751013 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.806807995 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.854830027 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.854892969 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.902831078 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.902884960 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.950803995 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.950859070 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.991278887 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.991430998 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996274948 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996284008 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996329069 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996335030 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996336937 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996391058 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996391058 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996400118 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996436119 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996443987 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996443987 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996480942 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996514082 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996521950 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996563911 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996637106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996644974 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996660948 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996669054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996694088 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996710062 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996711969 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996720076 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996767044 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996833086 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996840954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996848106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996884108 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996898890 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996915102 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.996926069 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996973038 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.996973991 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997004986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997021914 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997046947 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997060061 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997121096 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997128963 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997165918 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997174978 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997200966 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997231007 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997247934 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997262955 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997287035 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997309923 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997329950 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997329950 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997366905 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:18.997395992 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997402906 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:18.997448921 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001101017 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001153946 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001164913 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001194000 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001208067 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001230955 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001240969 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001276016 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001338959 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001360893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001375914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001385927 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001420021 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001462936 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001494884 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001512051 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001539946 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001559973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001569986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001626968 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001642942 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001714945 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001739025 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001743078 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001746893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001774073 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001782894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001784086 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001828909 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001837969 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001843929 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001863003 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001883030 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001890898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001892090 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001904011 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001910925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001935005 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001950026 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001966000 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.001972914 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.001974106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002007961 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002048016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002055883 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002104044 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002114058 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002121925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002171993 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002207994 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002216101 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002228022 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002234936 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002240896 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002263069 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002279997 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002302885 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002310991 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002316952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002331972 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002338886 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002357006 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002370119 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002387047 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002394915 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002418041 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002425909 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002444983 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002470970 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002485037 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002494097 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002533913 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002536058 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002543926 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002563000 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002569914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002578020 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002613068 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002645016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002651930 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002671957 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002680063 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002701998 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002737999 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002747059 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002754927 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002768993 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002789974 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002794027 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002824068 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002842903 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002851009 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002861023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002873898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002882004 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002893925 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002924919 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.002955914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.002964973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003007889 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003022909 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003031015 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003058910 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003066063 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003073931 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003103018 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003108025 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003110886 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003140926 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003155947 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003160000 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003166914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003204107 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003206015 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003211975 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003220081 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003247023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003254890 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003273964 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003317118 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003324986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003376961 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003376961 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003386974 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003432035 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.003473043 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003479958 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.003534079 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.005968094 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.005975962 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.005985975 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006036043 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006222963 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006231070 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006239891 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006272078 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006275892 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006310940 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006318092 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006319046 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006345034 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006349087 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006352901 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006395102 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006396055 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006402016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006445885 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006468058 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006477118 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006485939 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006522894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006534100 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006536961 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006577015 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006602049 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006608963 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006617069 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006645918 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006655931 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006696939 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006705046 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006756067 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006784916 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006792068 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006827116 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006834030 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006844044 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006886959 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006895065 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006902933 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006921053 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.006933928 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.006974936 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007014036 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007021904 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007072926 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007102013 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007110119 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007150888 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007157087 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007158995 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007200003 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007213116 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007225037 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007268906 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007273912 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007282972 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007297039 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007303953 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007342100 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007368088 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007378101 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007412910 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007416010 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007442951 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007491112 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007517099 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007524967 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007571936 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007584095 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007591009 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007620096 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007627964 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007644892 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007664919 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007664919 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007673979 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007704973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007708073 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007713079 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007719994 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007755041 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007774115 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007782936 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007829905 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007858992 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007867098 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007908106 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.007939100 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007946968 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007961988 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007987022 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.007998943 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008037090 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008074045 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008083105 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008127928 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008130074 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008137941 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008193970 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008219957 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008228064 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008234978 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008243084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008258104 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008265972 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008275986 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008313894 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008325100 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008332968 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008378029 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008385897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008390903 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008421898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008428097 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008430004 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008480072 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008487940 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008496046 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008543968 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008544922 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008553982 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008582115 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008589983 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008599997 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008641005 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008677006 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008690119 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008708954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008716106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008729935 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008732080 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008764029 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008768082 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008776903 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008811951 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008816004 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.008820057 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008877039 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008884907 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008920908 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008929014 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008958101 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.008970976 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009043932 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009042978 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009052038 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009090900 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009099007 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009135008 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009143114 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009171009 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009177923 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009232998 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009295940 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009304047 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009310961 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009318113 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009325027 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009335995 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009337902 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009344101 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009351969 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009371042 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009406090 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009459019 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009466887 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009473085 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009475946 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009489059 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009496927 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009529114 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009562016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009588957 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009609938 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009629011 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009635925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009644032 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009689093 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009702921 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009710073 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009732008 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009740114 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009746075 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009785891 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009823084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009830952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009876013 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009897947 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009919882 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009960890 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.009979963 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009988070 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.009999990 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010006905 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010039091 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010060072 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010062933 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010071039 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010112047 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010116100 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010124922 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010132074 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010147095 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010169983 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010186911 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010217905 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010226011 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010247946 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010256052 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010297060 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010319948 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010337114 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010361910 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010371923 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010466099 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010474920 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010519981 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010524988 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010529041 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010564089 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010569096 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010571957 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010616064 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010642052 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010651112 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010659933 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010675907 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010689020 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010705948 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010718107 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010732889 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010767937 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010771990 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010786057 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010833979 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.010963917 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.010972023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011015892 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011022091 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011030912 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011071920 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011097908 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011112928 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011120081 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011128902 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011148930 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011162043 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011176109 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011184931 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011187077 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011228085 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011236906 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011248112 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011298895 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011311054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011326075 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011343956 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011353016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011384964 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011404037 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011409044 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011418104 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011440992 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011455059 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011464119 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011509895 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011518955 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011526108 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011537075 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011537075 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011544943 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011554003 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011564970 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011584997 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011594057 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011640072 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011642933 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011648893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011694908 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011718035 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011725903 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011742115 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011749983 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011771917 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011786938 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011794090 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011802912 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011821985 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011830091 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011840105 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:19.011872053 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011881113 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011928082 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011935949 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.011967897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012002945 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012070894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012079954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012118101 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012165070 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012211084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012218952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012233973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012240887 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012304068 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012336016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012373924 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012458086 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012465954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012474060 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012531042 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012540102 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012547970 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012556076 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012595892 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012604952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012638092 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012645960 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012655973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012676954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012727022 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012734890 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012797117 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012808084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012815952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012830973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012881041 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012890100 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012970924 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012979984 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.012995005 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013010025 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013056040 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013063908 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013170958 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013179064 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013192892 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013201952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013288975 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013297081 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013310909 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013319969 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013350010 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013358116 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013389111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013448954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013457060 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013464928 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013494015 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013501883 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013540030 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013547897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013600111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013607979 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013642073 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013650894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013706923 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013715982 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013828993 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013838053 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013845921 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013854027 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013861895 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013870001 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013892889 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013900995 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013972044 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013981104 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.013994932 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014002085 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014046907 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014055014 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014110088 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014132977 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014148951 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014158010 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014219999 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014228106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014242887 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014250040 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014292002 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014300108 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014354944 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014364004 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014432907 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014441013 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014530897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014539003 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014600039 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014607906 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014651060 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014659882 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014717102 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014724970 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014786959 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014795065 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014825106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014832973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014873981 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014882088 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014935017 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014942884 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014986038 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.014993906 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015038967 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015047073 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015108109 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015116930 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015198946 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015208006 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015253067 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015260935 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015332937 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015371084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015441895 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015450001 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015505075 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015512943 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015556097 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015563965 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015590906 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015613079 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015688896 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015697002 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015712023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015718937 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015777111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015791893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015923977 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015933037 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015985012 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.015993118 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016000986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016009092 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016025066 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016032934 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016094923 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016103029 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016148090 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016163111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016207933 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016216993 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016263008 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016271114 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016302109 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016309977 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016319036 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016354084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016406059 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016415119 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016480923 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016489029 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016498089 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016511917 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016632080 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016639948 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016664982 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016685009 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016716957 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016726971 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016766071 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016774893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016860008 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016869068 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016911983 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016920090 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016971111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.016978979 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017047882 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017071009 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017118931 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017149925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017194986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017203093 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017255068 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017262936 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017316103 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017324924 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017338991 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017347097 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017404079 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017411947 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017438889 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017452955 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017507076 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017515898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017558098 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017566919 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017606974 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017615080 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017679930 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017688036 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017726898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017735004 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017745018 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017777920 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017828941 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017837048 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017960072 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.017968893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018017054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018030882 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018120050 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018136024 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018222094 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018230915 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018249989 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018300056 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018336058 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018343925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018416882 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018425941 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018464088 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018517017 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018578053 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018610954 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018687010 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018695116 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018733025 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018740892 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018791914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018800020 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018861055 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018876076 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018925905 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018934011 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018974066 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.018981934 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019095898 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019104958 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019212961 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019244909 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019356012 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019364119 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019481897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019515038 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019706011 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019756079 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019792080 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019824028 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019900084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019913912 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019970894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.019979000 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020052910 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020061016 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020131111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020138979 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020174026 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020181894 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020215988 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020225048 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020287991 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020296097 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020370007 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020384073 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020426989 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020452023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020508051 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020517111 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020536900 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020551920 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020684004 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020690918 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020745993 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020752907 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020795107 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020802021 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020857096 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020864010 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020905018 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020912886 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020973921 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.020994902 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021034956 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021071911 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021145105 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021152973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021198034 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021207094 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021298885 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021306992 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021361113 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021368027 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021404982 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021414995 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021514893 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021552086 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021605015 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021612883 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021696091 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021704912 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021755934 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021763086 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021815062 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021823883 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021858931 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021866083 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021928072 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021934986 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021961927 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.021994114 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022034883 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022042990 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022119045 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022126913 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022140980 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022152901 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022196054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022203922 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022252083 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022259951 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022325039 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022335052 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022412062 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022418976 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022454977 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022463083 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022499084 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022505999 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022550106 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022557974 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022594929 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022602081 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022641897 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022681952 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022727966 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022788048 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022833109 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022840023 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022872925 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022923946 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022931099 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022934914 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022968054 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.022975922 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023009062 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023015976 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023047924 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023066044 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023112059 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023174047 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023230076 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023236990 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023272991 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023329973 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.023365021 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:19.070772886 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.129434109 CET	55615	49711	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.132863998 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.137674093 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.137757063 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.138827085 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.143604994 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.173593044 CET	49711	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.486469030 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.491359949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491379023 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491403103 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491415024 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491436958 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.491447926 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491461039 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491465092 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.491507053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491519928 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491520882 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.491534948 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491569042 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.491609097 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.491626024 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496215105 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496288061 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496304989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496316910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496371984 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496376991 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496396065 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496404886 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496422052 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.496433973 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496445894 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.496474028 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.538769007 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.538901091 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.590773106 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.590928078 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.606453896 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.606612921 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611480951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611495018 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611509085 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611557007 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611563921 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611591101 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611613035 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611614943 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611625910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611666918 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611677885 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611677885 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611732960 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611763954 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611777067 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611804962 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611823082 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611824036 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611865044 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611874104 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611895084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611927986 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611928940 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611972094 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.611973047 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.611996889 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612021923 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612029076 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612036943 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612076998 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612092018 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612176895 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612189054 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612200975 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612211943 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612226009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612241983 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612258911 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612278938 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612291098 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612293959 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612323046 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612328053 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612355947 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612359047 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612384081 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612397909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.612404108 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.612448931 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.616322041 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616389036 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.616442919 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616612911 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.616617918 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616631031 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616707087 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616710901 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.616743088 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.616795063 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.616817951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617275953 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617352009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617363930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617374897 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617381096 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617386103 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617407084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617419958 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617423058 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617439985 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617449045 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617459059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617477894 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617496014 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617497921 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617523909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617527962 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617537975 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617557049 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617578030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617583990 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617609024 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617629051 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617630959 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617643118 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617655993 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617669106 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617687941 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617712021 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617719889 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617739916 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617753983 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617774963 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617809057 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617810965 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617825031 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617845058 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617857933 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617880106 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617892027 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617913008 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617925882 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617928028 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617959976 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617964983 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.617971897 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617988110 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.617990971 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618016005 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618027925 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618041039 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618066072 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618081093 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618088961 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618119001 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618140936 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618163109 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618190050 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618242025 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618242979 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618288994 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618323088 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618344069 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618366003 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.618386030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.618437052 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621205091 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621259928 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621289015 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621362925 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621416092 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621481895 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621589899 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621601105 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621620893 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621633053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621640921 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621665001 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621680021 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621691942 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621701956 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621727943 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621741056 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621748924 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621752977 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621783018 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621788979 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621794939 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.621818066 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.621845961 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622165918 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622231960 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622258902 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622272015 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622320890 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622337103 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622349977 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622370958 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622381926 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622400045 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622416973 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622428894 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622436047 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622471094 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622483015 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622497082 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622498989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622510910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622538090 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622545004 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622560024 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622566938 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622606039 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622616053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622627974 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622658968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622669935 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622673988 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622690916 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622703075 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622740984 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622740984 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622754097 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622772932 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622785091 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622790098 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622798920 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622817039 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622821093 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622833967 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622847080 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622867107 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622898102 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.622910023 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622922897 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622945070 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622956038 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.622998953 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623024940 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623038054 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623054028 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623073101 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623085022 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623095989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623102903 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623106956 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623122931 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623131990 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623142958 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623171091 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623174906 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623183966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623212099 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623213053 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623224020 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623246908 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623256922 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623266935 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623280048 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623291969 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623301029 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623325109 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623327971 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623347044 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623358011 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623366117 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623393059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623405933 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623418093 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623433113 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623444080 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623462915 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623477936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623491049 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623501062 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623508930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623523951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623529911 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623552084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623564005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623570919 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623579979 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623591900 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623604059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623614073 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623639107 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623641014 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623658895 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623661995 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623692036 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623716116 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623725891 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623728037 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623761892 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623765945 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623774052 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623790979 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623805046 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623814106 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623817921 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623862982 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623904943 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623918056 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623955965 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.623956919 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.623969078 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624010086 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624022007 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624023914 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624062061 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624068022 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624074936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624103069 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624114037 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624118090 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624145985 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624156952 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624161005 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624187946 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624201059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624222040 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624228001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624239922 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624259949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624264002 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624272108 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624291897 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624320984 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624345064 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624357939 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624367952 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624387980 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624399900 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624399900 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624404907 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624416113 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624425888 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624442101 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624466896 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624480009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624485970 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624500036 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624511003 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624526978 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624531984 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624545097 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624571085 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624572992 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624584913 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624596119 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.624672890 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.624713898 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626059055 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626117945 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626167059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626257896 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626295090 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626307964 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626318932 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626343966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626355886 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626370907 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626394987 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626424074 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626436949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626487017 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626488924 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626569986 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626574039 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626583099 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626620054 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626626015 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626638889 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626667023 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626667976 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626678944 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626739025 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626753092 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626753092 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626768112 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626791000 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626816988 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626825094 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626831055 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626879930 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626880884 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626893997 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626935959 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626938105 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.626948118 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.626998901 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627033949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627048016 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627075911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627087116 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627105951 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627134085 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627149105 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627159119 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627181053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627198935 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627228022 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627230883 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627244949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627295017 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627355099 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627367973 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627388000 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627399921 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627417088 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627419949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627432108 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627443075 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627468109 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627496004 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627497911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627517939 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627543926 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627551079 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627563953 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627571106 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627585888 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627597094 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627609968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627613068 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627646923 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627651930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627665043 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627671003 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627676964 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627707005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627708912 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627720118 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627720118 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627759933 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627759933 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627777100 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627790928 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627809048 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627820969 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627823114 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627835035 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627871037 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627886057 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627898932 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627909899 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627950907 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627965927 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627979040 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.627985001 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.627999067 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628032923 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628057957 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628134966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628189087 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628261089 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628273964 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628329992 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628338099 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628350019 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628376961 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628387928 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628388882 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628428936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628431082 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628444910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628457069 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628483057 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628490925 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628503084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628511906 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628534079 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628545046 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628546000 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628592968 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628602028 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628613949 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628634930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628645897 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628659964 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628664017 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628670931 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628710032 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628714085 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628722906 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628740072 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628757000 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628768921 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628782988 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628793955 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628817081 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628820896 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628830910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628843069 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628878117 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628885031 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628896952 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628899097 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628911018 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628923893 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628938913 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628963947 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.628968000 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.628988981 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629019022 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629050970 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629179955 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629190922 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629211903 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629221916 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629234076 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629239082 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629264116 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629282951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629287004 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629321098 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629328966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629340887 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629344940 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629357100 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629369020 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629396915 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629411936 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629436016 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629447937 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629483938 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629498005 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629530907 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629530907 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629559994 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629571915 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629605055 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629616976 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629616976 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629637003 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629664898 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629669905 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629683971 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629703999 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629715919 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629724026 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629770041 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:20.629777908 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629791021 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629801989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629812956 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629832029 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629842997 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629868984 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629879951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629916906 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629929066 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629947901 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.629959106 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630001068 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630012035 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630038977 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630049944 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630106926 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630117893 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630172968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630184889 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630220890 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630232096 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630250931 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630260944 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630343914 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630371094 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630382061 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630393028 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630405903 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630418062 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630438089 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630449057 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630500078 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630511045 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630574942 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630585909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630605936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630618095 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630652905 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630664110 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630686045 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630697012 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630709887 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630728960 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630815029 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630825996 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630881071 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630892992 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630913019 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630923986 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630958080 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.630970001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631000996 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631012917 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631025076 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631138086 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631150007 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631160975 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631171942 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631182909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631203890 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631215096 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631226063 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631237030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631258011 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631268978 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631289005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631299973 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631329060 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631340981 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631381989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631393909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631418943 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631429911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631469011 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631479979 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631509066 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631520987 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631567001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631580114 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631632090 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631644011 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631664038 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631675005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631716967 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631727934 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631777048 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631788969 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631834030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631845951 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631865025 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631876945 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631896973 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631907940 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631938934 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631951094 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.631995916 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632009029 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632041931 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632052898 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632118940 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632132053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632152081 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632164001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632227898 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632240057 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632251978 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632262945 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632283926 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632294893 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632328033 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632339001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632379055 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632391930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632463932 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632474899 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632517099 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632529020 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632555962 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632567883 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632608891 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632620096 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632664919 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632675886 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632695913 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632708073 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632728100 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632739067 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632797956 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632811069 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632831097 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632842064 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632862091 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632873058 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632915974 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632926941 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632949114 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632960081 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.632999897 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633011103 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633049011 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633060932 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633081913 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633093119 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633138895 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633150101 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633168936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633181095 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633220911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633233070 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633316040 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633328915 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633339882 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633351088 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633371115 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633382082 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633402109 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633414030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633490086 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633502007 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633512974 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633523941 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633543968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633555889 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633565903 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633578062 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633598089 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633610010 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633630037 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633641005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633676052 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633687019 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633711100 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633723021 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633754969 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633765936 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633799076 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633810043 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633856058 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633867025 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633898973 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633909941 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633929968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633940935 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633984089 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.633995056 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634015083 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634027004 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634066105 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634077072 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634111881 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634123087 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634155989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634166956 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634202957 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634213924 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634258032 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634269953 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634289980 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634300947 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634341002 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634351969 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634371042 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634382963 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634454012 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634465933 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634475946 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634488106 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634507895 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634520054 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634540081 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634551048 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634596109 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634608030 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634620905 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634633064 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634669065 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634680986 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634695053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634721041 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634768009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634779930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634799957 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634812117 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634835005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634845972 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634897947 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634910107 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634928942 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634939909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634968042 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.634979010 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635025024 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635036945 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635056019 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635066986 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635092974 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635103941 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635143995 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635154963 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635175943 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635186911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635226965 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635237932 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635279894 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635291100 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635310888 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635328054 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635349035 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635360956 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635420084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635432005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635472059 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635483980 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635497093 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635508060 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635536909 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635548115 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635569096 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635581017 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635628939 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635641098 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635660887 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635672092 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635705948 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635718107 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635736942 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635747910 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635766029 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635776997 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635859966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635871887 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635885000 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635895967 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635951042 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635962963 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635982990 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.635993958 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636013985 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636024952 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636059046 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636070967 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636090994 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636102915 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636137009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636148930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636162043 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636223078 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636234045 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636245012 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636265993 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636276960 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636290073 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636301041 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636348009 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636359930 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636380911 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636392117 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636411905 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636424065 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636457920 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636470079 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636488914 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636499882 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636575937 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636586905 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636598110 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636609077 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636630058 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636641026 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636661053 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636672020 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636693001 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636703968 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636723995 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636734962 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636776924 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636789083 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636831045 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636842966 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636918068 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636929989 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636970997 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.636982918 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637011051 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637022018 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637042046 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637053013 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637100935 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637111902 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637157917 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637168884 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637211084 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637223005 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637242079 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637253046 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637285948 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637298107 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637317896 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637329102 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637341976 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637401104 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637413025 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637423038 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637444019 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637454987 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.637466908 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:20.678750992 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:21.659349918 CET	55615	49712	45.137.22.234	192.168.2.5
Feb 15, 2025 21:01:21.677372932 CET	49712	55615	192.168.2.5	45.137.22.234
Feb 15, 2025 21:01:21.677992105 CET	49711	55615	192.168.2.5	45.137.22.234

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 15, 2025 21:01:15.973817110 CET	59407	53	192.168.2.5	1.1.1.1
Feb 15, 2025 21:01:15.980680943 CET	53	59407	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 15, 2025 21:01:15.973817110 CET	192.168.2.5	1.1.1.1	0x74c1	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 15, 2025 21:01:15.980680943 CET	1.1.1.1	192.168.2.5	0x74c1	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 15, 2025 21:01:15.980680943 CET	1.1.1.1	192.168.2.5	0x74c1	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.12.31	A (IP address)	IN (0x0001)	false
Feb 15, 2025 21:01:15.980680943 CET	1.1.1.1	192.168.2.5	0x74c1	No error (0)	api.ip.sb.cdn.cloudflare.net		172.67.75.172	A (IP address)	IN (0x0001)	false
Feb 15, 2025 21:01:15.980680943 CET	1.1.1.1	192.168.2.5	0x74c1	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.13.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ip.sb

45.137.22.234:55615

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	45.137.22.234	55615	1248	C:\Users\user\Desktop\A18OkaGxHz.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 21:01:09.609738111 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 45.137.22.234:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Feb 15, 2025 21:01:10.199235916 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 16 Feb 2025 03:01:08 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Feb 15, 2025 21:01:15.274065018 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 45.137.22.234:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 15, 2025 21:01:15.474322081 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 10809 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 16 Feb 2025 03:01:13 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>183.197.44.144</b:string><b:string>113.132.183.77</b:string><b:string>113.73.237.73</b:string><b:string>119.130.131.242</b:string><b:string>183.245.29.139</b:string><b:string>113.120.83.102</b:string><b:string>218.77.103.84</b:string><b:string>218.77.103.84</b:string><b:string>117.84.202.254</b:string><b:string>89.251.26.11</b:string><b:string>119.112.124.49</b:string><b:string>219.130.184.162</b:string><b:string>139.186.206.86</b:string><b:string>60.184.203.156</b:string><b:string>117.81.13.205</b:string><b:string>115.60.61.127</b:string><b:string>183.17.50.99</b:string><b:string>120.34.88.1 [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	45.137.22.234	55615	1248	C:\Users\user\Desktop\A18OkaGxHz.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 21:01:18.553992033 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 45.137.22.234:55615 Content-Length: 958598 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 15, 2025 21:01:20.129434109 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 16 Feb 2025 03:01:18 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49712	45.137.22.234	55615	1248	C:\Users\user\Desktop\A18OkaGxHz.exe

Timestamp	Bytes transferred	Direction	Data
Feb 15, 2025 21:01:20.138827085 CET	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 45.137.22.234:55615 Content-Length: 958590 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Feb 15, 2025 21:01:21.659349918 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 16 Feb 2025 03:01:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	104.26.12.31	443	1248	C:\Users\user\Desktop\A18OkaGxHz.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-15 20:01:16 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-02-15 20:01:16 UTC	941	IN	HTTP/1.1 200 OK Date: Sat, 15 Feb 2025 20:01:16 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BgL6lBP68XOi9x%2FCA7sOGJGtTh4nHYk7xjGkZdAkRek2SWHeyW7MetCv8JN4SQ%2FfEvRzfSc%2FW77gJiXMVI8T0hj2ZFpdp6IhvR2yjuQgKOLNsaS7S7x6LQQlLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 9127e38e8aae4232-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2039&min_rtt=2037&rtt_var=769&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2807&recv_bytes=678&delivery_rate=1417475&cwnd=217&unsent_bytes=0&cid=a1aa7a1c6d99bac4&ts=450&x=0"
2025-02-15 20:01:16 UTC	351	IN	Data Raw: 31 35 38 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 6c 61 74 69 74 75 64 65 Data Ascii: 158{"organization":"CenturyLink","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"CenturyLink","offset":-18000,"region":"New York","asn":3356,"asn_organization":"LEVEL3","country":"United States","ip":"8.46.123.189","latitude
2025-02-15 20:01:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:01:07
Start date:	15/02/2025
Path:	C:\Users\user\Desktop\A18OkaGxHz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A18OkaGxHz.exe"
Imagebase:	0x8c0000
File size:	689'664 bytes
MD5 hash:	0241FF0075C6A2192E14CC9E0D040A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2041012873.0000000003C39000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2041012873.0000000004492000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:01:08
Start date:	15/02/2025
Path:	C:\Users\user\Desktop\A18OkaGxHz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\A18OkaGxHz.exe"
Imagebase:	0xb70000
File size:	689'664 bytes
MD5 hash:	0241FF0075C6A2192E14CC9E0D040A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000003.00000002.2169905844.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:01:08
Start date:	15/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report A18OkaGxHz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A18OkaGxHz.exe.log

C:\Users\user\AppData\Local\Temp\tmp27DE.tmp

C:\Users\user\AppData\Local\Temp\tmp27EE.tmp

C:\Users\user\AppData\Local\Temp\tmp280F.tmp

C:\Users\user\AppData\Local\Temp\tmp283F.tmp

C:\Users\user\AppData\Local\Temp\tmp6103.tmp

C:\Users\user\AppData\Local\Temp\tmp6123.tmp

C:\Users\user\AppData\Local\Temp\tmp6134.tmp

C:\Users\user\AppData\Local\Temp\tmp6154.tmp

C:\Users\user\AppData\Local\Temp\tmp6165.tmp

C:\Users\user\AppData\Local\Temp\tmp795F.tmp

C:\Users\user\AppData\Local\Temp\tmp796F.tmp

C:\Users\user\AppData\Local\Temp\tmp7970.tmp

C:\Users\user\AppData\Local\Temp\tmp7971.tmp

C:\Users\user\AppData\Local\Temp\tmp7982.tmp

C:\Users\user\AppData\Local\Temp\tmp7983.tmp

Windows Analysis Report
A18OkaGxHz.exe