Play interactive tour

Edit tour

Analysis Report Scan_00059010189_ ref. 004118379411_ pdf.exe

Overview

General Information

Sample Name:	Scan_00059010189_ ref. 004118379411_ pdf.exe
Analysis ID:	337758
MD5:	106117a9928b774aa6bbb657f275de53
SHA1:	208d61ecd30789fba2325a0e0f46bb63bdba5bd9
SHA256:	a5affcfc364530db52dd4fcf252187cc09968a7bb1f1149bb919fd339634468a
Tags:	exeNanoCoreRAT
Most interesting Screenshot:
Errors Sigma syntax error: Has an empty selector, Rule: Abusing Azure Browser SSO

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected Nanocore Rat

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected Nanocore RAT

Allocates memory in foreign processes

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

Scan_00059010189_ ref. 004118379411_ pdf.exe (PID: 4532 cmdline: 'C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe' MD5: 106117A9928B774AA6BBB657F275DE53)

RegAsm.exe (PID: 5764 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)

schtasks.exe (PID: 4392 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5436 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp606.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegAsm.exe (PID: 6028 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 0 MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 4944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 4948 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 5644 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 6FD7592411112729BF6B1F2F6C34899F)

conhost.exe (PID: 1624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x442ed:$x1: NanoCore.ClientPluginHost 0x76f1d:$x1: NanoCore.ClientPluginHost 0xa993d:$x1: NanoCore.ClientPluginHost 0x4432a:$x2: IClientNetworkHost 0x76f5a:$x2: IClientNetworkHost 0xa997a:$x2: IClientNetworkHost 0x47e5d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7aa8d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xad4ad:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x44055:$a: NanoCore 0x44065:$a: NanoCore 0x44299:$a: NanoCore 0x442ad:$a: NanoCore 0x442ed:$a: NanoCore 0x76c85:$a: NanoCore 0x76c95:$a: NanoCore 0x76ec9:$a: NanoCore 0x76edd:$a: NanoCore 0x76f1d:$a: NanoCore 0xa96a5:$a: NanoCore 0xa96b5:$a: NanoCore 0xa98e9:$a: NanoCore 0xa98fd:$a: NanoCore 0xa993d:$a: NanoCore 0x440b4:$b: ClientPlugin 0x442b6:$b: ClientPlugin 0x442f6:$b: ClientPlugin 0x76ce4:$b: ClientPlugin 0x76ee6:$b: ClientPlugin 0x76f26:$b: ClientPlugin
Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfb31:$x1: NanoCore.ClientPluginHost 0x2e4b0:$x1: NanoCore.ClientPluginHost 0x4cd44:$x1: NanoCore.ClientPluginHost 0xfb92:$x2: IClientNetworkHost 0x2e511:$x2: IClientNetworkHost 0x4cda5:$x2: IClientNetworkHost 0x14f97:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x22f09:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x33916:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x41888:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x521aa:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x6011c:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf636:$a: NanoCore 0xf652:$a: NanoCore 0xf7ad:$a: NanoCore 0xf7bc:$a: NanoCore 0xfa95:$a: NanoCore 0xfac1:$a: NanoCore 0xfb31:$a: NanoCore 0x1f573:$a: NanoCore 0x1f585:$a: NanoCore 0x1f5c1:$a: NanoCore 0x2dfb5:$a: NanoCore 0x2dfd1:$a: NanoCore 0x2e12c:$a: NanoCore 0x2e13b:$a: NanoCore 0x2e414:$a: NanoCore 0x2e440:$a: NanoCore 0x2e4b0:$a: NanoCore 0x3def2:$a: NanoCore 0x3df04:$a: NanoCore 0x3df40:$a: NanoCore 0x4c849:$a: NanoCore
Click to see the 1 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ProcessId: 5764, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, ParentProcessId: 5764, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp', ProcessId: 4392

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe	Virustotal: Detection: 57%			Perma Link
Source: Scan_00059010189_ ref. 004118379411_ pdf.exe	ReversingLabs: Detection: 58%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY

Machine Learning detection for sample

Show sources

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Joe Sandbox ML: detected

Source: 1.2.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 1.0.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RunPE.pdb source: Scan_00059010189_ ref. 004118379411_ pdf.exe, 00000001.00000002.233684353.0000000002A01000.00000004.00000001.sdmp
Source:	Binary string: RegAsm.pdb source: dhcpmon.exe, dhcpmon.exe.2.dr
Source:	Binary string: RegAsm.pdb4 source: dhcpmon.exe, 0000000A.00000002.268427132.00000000007C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.270489024.0000000000E92000.00000002.00020000.sdmp, dhcpmon.exe.2.dr
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: RegAsm.exe, 00000002.00000003.425640561.0000000003F52000.00000004.00000001.sdmp

Source: global traffic

TCP traffic: 192.168.2.5:49714 -> 185.244.38.210:7008

Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.38.210

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Code function: 1_2_01111811	1_2_01111811
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Code function: 1_2_01111820	1_2_01111820
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Code function: 1_2_011115B1	1_2_011115B1
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Code function: 1_2_011115C0	1_2_011115C0
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Code function: 1_2_01110682	1_2_01110682
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_007C3DFE	10_2_007C3DFE
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_00E93DFE	12_2_00E93DFE

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe, 00000001.00000002.233684353.0000000002A01000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenameRunPE.dll" vs Scan_00059010189_ ref. 004118379411_ pdf.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll			Jump to behavior

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe, hpCGGsxnBfkpZyTC.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.2.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack, hpCGGsxnBfkpZyTC.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 1.0.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack, hpCGGsxnBfkpZyTC.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@15/14@0/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan_00059010189_ ref. 004118379411_ pdf.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4944:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{003adc3a-22f1-4bc1-a79f-fc8c7d09606c}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:408:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3536:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1624:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp

Jump to behavior

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe	Virustotal: Detection: 57%
Source: Scan_00059010189_ ref. 004118379411_ pdf.exe	ReversingLabs: Detection: 58%

Source: unknown	Process created: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe 'C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp606.tmp'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp606.tmp'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: RunPE.pdb source: Scan_00059010189_ ref. 004118379411_ pdf.exe, 00000001.00000002.233684353.0000000002A01000.00000004.00000001.sdmp
Source:	Binary string: RegAsm.pdb source: dhcpmon.exe, dhcpmon.exe.2.dr
Source:	Binary string: RegAsm.pdb4 source: dhcpmon.exe, 0000000A.00000002.268427132.00000000007C2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000C.00000002.270489024.0000000000E92000.00000002.00020000.sdmp, dhcpmon.exe.2.dr
Source:	Binary string: C:\Users\Liam\Documents\Visual Studio 2013\Projects\NanoCoreStressTester\NanoCoreStressTester\obj\Debug\NanoCoreStressTester.pdb source: RegAsm.exe, 00000002.00000003.425640561.0000000003F52000.00000004.00000001.sdmp

Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_007C4469 push cs; retf	10_2_007C449E
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_007C44A3 push es; retf	10_2_007C44A4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 10_2_007C4289 push es; retf	10_2_007C4294
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_00E94469 push cs; retf	12_2_00E9449E
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_00E944A3 push es; retf	12_2_00E944A4
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Code function: 12_2_00E94289 push es; retf	12_2_00E94294

Source: initial sample

Static PE information: section name: .text entropy: 7.99662602027

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4629	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4928	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 623	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: foregroundWindowGot 751	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe TID: 4536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 1460	Thread sleep time: -23058430092136925s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 4604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 4620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 1132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A6D008	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp606.tmp'	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Queries volume information: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM AntiSpywareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT DisplayName FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: Scan_00059010189_ ref. 004118379411_ pdf.exe, 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegAsm.exe, 00000002.00000003.281602709.0000000006405000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job1	Process Injection311	Masquerading2	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	DLL Side-Loading1	Scheduled Task/Job1	Virtualization/Sandbox Evasion2	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	DLL Side-Loading1	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection311	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	DLL Side-Loading1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Scan_00059010189_ ref. 004118379411_ pdf.exe	58%	Virustotal		Browse
Scan_00059010189_ ref. 004118379411_ pdf.exe	59%	ReversingLabs	ByteCode-MSIL.Trojan.Cryptos
Scan_00059010189_ ref. 004118379411_ pdf.exe	100%	Avira	TR/Dropper.MSIL.Gen
Scan_00059010189_ ref. 004118379411_ pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen		Download File
1.0.Scan_00059010189_ ref. 004118379411_ pdf.exe.760000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.38.210	unknown	Netherlands		8100	ASN-QUADRANET-GLOBALUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	337758
Start date:	10.01.2021
Start time:	08:24:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Scan_00059010189_ ref. 004118379411_ pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@15/14@0/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 2.3% (good quality ratio 2%) Quality average: 65.9% Quality standard deviation: 26.6%
HCA Information:	Successful, ratio: 100% Number of executed functions: 25 Number of non-executed functions: 5
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found.
Errors:	Sigma syntax error: Has an empty selector, Rule: Abusing Azure Browser SSO

Simulations

Behavior and APIs

Time	Type	Description
08:25:23	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
08:25:30	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" s>$(Arg0)
08:25:30	API Interceptor	1340x Sleep call for process: RegAsm.exe modified
08:25:31	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.244.38.210	Payment_Confirmation pdf.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASN-QUADRANET-GLOBALUS	nh8712Nx5J.xls	Get hash	malicious	Browse	185.174.102.105
	Payment_Confirmation pdf.exe	Get hash	malicious	Browse	185.244.38.210
	npp.7.9.2.Installer (1).exe	Get hash	malicious	Browse	192.169.6.95
	https://linkprotect.cudasvc.com/url?a=http%3a%2f%2ffindcloud.id%2fwp-includes%2f8JTmzq3FN6z3OBJBdBCfXrdcZl5H7ZxOaOZzfl2H%2f&c=E,1,2CiyC7FGbs3Pvr1yrAWkewOmRL-xyrP42HL37xX4omRyLZqRrqWOt_1RKb6pLtfzxs7zIBTrrVMEwQ8pOUIr2mFuNwrd9eHNrfkptUp83QPlV-CrGIoXMw,,&typo=1	Get hash	malicious	Browse	173.254.250.226
	https://mrveggy.com/resgatecarrinho/jcWVa69vj8IDsQRCud8h6RNI9Mz17JqsPPJ0DFnlbXZGyMM2GcZ3/	Get hash	malicious	Browse	173.254.250.226
	1I72L29IL3F.doc	Get hash	malicious	Browse	173.254.250.226
	https://x9sademwnet.gb.net/bnbgfvgrthbg456tr54g6trvecds/?tuk5sx4dsb3=7df34dj4csa	Get hash	malicious	Browse	104.129.25.9
	xLH4kwOjXR.exe	Get hash	malicious	Browse	104.223.94.66
	utox.exe	Get hash	malicious	Browse	104.223.122.15
	QUOTES.exe	Get hash	malicious	Browse	69.174.99.26
	file.exe	Get hash	malicious	Browse	192.161.187.200
	http://jb092.com/rxlbakzd/goqmmbmi.html?kjmikw5x.3hllr	Get hash	malicious	Browse	185.174.103.81
	https://www.trackins.org/sale/cat/sale-c199387IoAL&C_fTkoAvATBo-1LAvvTgoAKL6_.T5.html?_emr=12e4edca-8183-44e0-bccb-e3d6e0eeb447&wfcs=cs2&dcrectxid=d48055ba-93d6-4b3f-80c6-70de3252bde6&_eml=2ec38d65-f3da-4587-bd38-7c1f333c6dc8&source=batch&batchid=04&varid=5&csnid=1eab81b4-e54d-4cc2-8735-a5d571cfe688&brcid=13&sm=1&refid=MKTEML_31000&emlid=1131&maiid=1913	Get hash	malicious	Browse	173.205.83.250
	Shipment Document BLINV And Packing List Attached.exe	Get hash	malicious	Browse	192.161.187.200
	kWbmxCNnPIYLMvvPIVlMbDKbbQCNjT.exe	Get hash	malicious	Browse	69.174.99.26
	Purchase Order.exe	Get hash	malicious	Browse	104.129.26.162
	SecuriteInfo.com.Variant.Bulz.265335.2250.exe	Get hash	malicious	Browse	66.63.162.20
	New order.xls	Get hash	malicious	Browse	66.63.162.20
	https://app.box.com/s/rdobxcyrhp1cdxwej3pfeyvngfh3lwag	Get hash	malicious	Browse	173.254.237.250
	https://bit.ly/2VPfIRO	Get hash	malicious	Browse	185.174.103.81

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	hfix.exe	Get hash	malicious	Browse
	atikmdag-patcher 1.4.8.exe	Get hash	malicious	Browse
	Client1.exe	Get hash	malicious	Browse
	miner.exe	Get hash	malicious	Browse
	PhoenixMiner_5.4c_Windows.exe	Get hash	malicious	Browse
	74725794.exe	Get hash	malicious	Browse
	PO-498475-ORDER.vbs	Get hash	malicious	Browse
	Payment Advice Note from 19.11.2020.exe	Get hash	malicious	Browse
	SUSPENSION LETTER ON SIM SWAP.pdf.exe	Get hash	malicious	Browse
	kiiDjfpu2x.exe	Get hash	malicious	Browse
	invoice copy.exe	Get hash	malicious	Browse
	purchase_order.exe	Get hash	malicious	Browse
	LC No 075120020789.exe	Get hash	malicious	Browse
	pRTOIqmIH5.exe	Get hash	malicious	Browse
	M9Xn52MsfG.exe	Get hash	malicious	Browse
	ycqE1CONpY.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.461.28807.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.461.31996.exe	Get hash	malicious	Browse
	7RP240Rsf3.exe	Get hash	malicious	Browse
	JPY79XL8cl.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64616
Entropy (8bit):	6.037264560032456
Encrypted:	false
SSDEEP:	768:J8XcJiMjm2ieHlPyCsSuJbn8dBhFVBSMQ6Iq8TSYDKpgLaDViRLNdr:9YMaNylPYSAb8dBnTHv8DKKaDVkX
MD5:	6FD7592411112729BF6B1F2F6C34899F
SHA1:	5E5C839726D6A43C478AB0B95DBF52136679F5EA
SHA-256:	FFE4480CCC81B061F725C54587E9D1BA96547D27FE28083305D75796F2EB3E74
SHA-512:	21EFCC9DEE3960F1A64C6D8A44871742558666BB792D77ACE91236C7DBF42A6CA77086918F363C4391D9C00904C55A952E2C18BE5FA1A67A509827BFC630070D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: hfix.exe, Detection: malicious, Browse Filename: atikmdag-patcher 1.4.8.exe, Detection: malicious, Browse Filename: Client1.exe, Detection: malicious, Browse Filename: miner.exe, Detection: malicious, Browse Filename: PhoenixMiner_5.4c_Windows.exe, Detection: malicious, Browse Filename: 74725794.exe, Detection: malicious, Browse Filename: PO-498475-ORDER.vbs, Detection: malicious, Browse Filename: Payment Advice Note from 19.11.2020.exe, Detection: malicious, Browse Filename: SUSPENSION LETTER ON SIM SWAP.pdf.exe, Detection: malicious, Browse Filename: kiiDjfpu2x.exe, Detection: malicious, Browse Filename: invoice copy.exe, Detection: malicious, Browse Filename: purchase_order.exe, Detection: malicious, Browse Filename: LC No 075120020789.exe, Detection: malicious, Browse Filename: pRTOIqmIH5.exe, Detection: malicious, Browse Filename: M9Xn52MsfG.exe, Detection: malicious, Browse Filename: ycqE1CONpY.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.461.28807.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.PackedNET.461.31996.exe, Detection: malicious, Browse Filename: 7RP240Rsf3.exe, Detection: malicious, Browse Filename: JPY79XL8cl.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...xX.Z..............0.............^.... ........@.. ....................... ............`.....................................O.......8...............h>........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...8...........................@..@.reloc..............................@..B................@.......H........A...p..........T................................................~P...-.r...p.....(....(....s.....P.....0.."........(......-.r...p.rI..p(....s....z....0..........(....~P.....o........(....n(.....(..........%...(....~(.....(..........%...%...(.....(.....(..........%...%...%...(....V.(......}Q.....}R.....{Q.....{R......0...........(.......i.=...}S......i.@...}T......i.@...}U.....+m...(....o .....r]..p.o!...,..{T.......{U........o"....+(.ra..p.o!...,..{T.......

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Scan_00059010189_ ref. 004118379411_ pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.348034597186669
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhav:MLU84qpE4Ks2wKDE4KhK3VZ9pKhk
MD5:	D4AF6B20AEA9906B4FF574A174E96287
SHA1:	81655019BB100FAADD5B36755F798EE5FB09E672
SHA-256:	DD8AE93DA079839B31327D22A2408E0C3EA4DDE92FD389CD5B96AD57CCE7B2E1
SHA-512:	6D912AC17876D9C21E61ED8C1B435AEA0FBB27FB97626A40903B4DFFC1204BEF3A43B02805DEDD2531822FD6F62CF06F0D758C1B2CA07258E82F95225D71C16E
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Temp\tmp606.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	5.134254141338449
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mxz5xtn:cbk4oL600QydbQxIYODOLedq3Zxz5j
MD5:	48EF7FA9033389AD7929D7A6B9D10298
SHA1:	9DB6CB7325C8BDF66A15F7B5F34703709A45AEB6
SHA-256:	0C1B5F67EEB276D1D4205B138CE32BC6149924E02281A2DB8E4623A700E88F15
SHA-512:	AC8BD104ECBACC9BCCCE9E087F67E5B18072D59367CCD31D4E66132B6BAAEA520CBA5B9B59464483D86ABF74826B382C402F12E9A586C99BDA8C78A0DE33944E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	7.108278141116062
Encrypted:	false
SSDEEP:	48:SUzDgcUzDgcUzDgcUzDgcUzDgcUzDgcUzDgcUzDgcUzDgd:nMMMMMMMMk
MD5:	D0CECEFBB6FCD57CDF6D49B3E30AD972
SHA1:	BA83D28BB3EBBB383D5A64F5ABF4E1804CFE5A7D
SHA-256:	90CD93824ED95C0CB0E805CC42196D8A81538B8152A08B2EA00736BA22DDE2F0
SHA-512:	36789EFE742431D38E6508AEC3F15F4F0579EC44C63E659C422904D0A236D55A70347C91817CF39274BC34F244D8C697E2E4FFAB331FF6939579743F397CAAEC
Malicious:	false
Preview:	>........]Z.S..._;yF..6..p..GK.>0hn....EY.+..U..y.Z..t.Z...k....s..\.'.i..pr....Y..Y..q......'..z..P.....:.....F[?..6My\|...5.............".@..i,F.H....H.....\|U.y.,...z...}...,:...C{v.Q.5.......&.:.Z.}.. ..3..T..........^3...f.1......7%.]..2_>........]Z.S..._;yF..6..p..GK.>0hn....EY.+..U..y.Z..t.Z...k....s..\.'.i..pr....Y..Y..q......'..z..P.....:.....F[?..6My\|...5.............".@..i,F.H....H.....\|U.y.,...z...}...,:...C{v.Q.5.......&.:.Z.}.. ..3..T..........^3...f.1......7%.]..2_>........]Z.S..._;yF..6..p..GK.>0hn....EY.+..U..y.Z..t.Z...k....s..\.'.i..pr....Y..Y..q......'..z..P.....:.....F[?..6My\|...5.............".@..i,F.H....H.....\|U.y.,...z...}...,:...C{v.Q.5.......&.:.Z.}.. ..3..T..........^3...f.1......7%.]..2_>........]Z.S..._;yF..6..p..GK.>0hn....EY.+..U..y.Z..t.Z...k....s..\.'.i..pr....Y..Y..q......'..z..P.....:.....F[?..6My\|...5.............".@..i,F.H....H.....\|U.y.,...z...}...,:...C{v.Q.5.......&.:.Z.}.. ..3..T..........^3...f.1......7%.]..2_>......

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:Tt:h
MD5:	250442B41A1BC064560EF4F540927AC8
SHA1:	FDCFF45A028F804339F044080C2FB8BECB38CB29
SHA-256:	A83C93546468FE86A6CE1A8A01A8779C001D50DA4D3108BB3AB9150746A758B5
SHA-512:	C9850CE77471752369464B559D9C80C4977E9F02BFAD92B17F56AAEF53D095F7262DCF63E45C4380AA1EC1D1DA9F427B1CEAF45C5C894D3A23176D6017CE56FF
Malicious:	true
Preview:	.%.R...H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\settings.bin Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	5.221928094887364
Encrypted:	false
SSDEEP:	3:9bzY6oRDMjmPl:RzWDMCd
MD5:	AE0F5E6CE7122AF264EC533C6B15A27B
SHA1:	1265A495C42EED76CC043D50C60C23297E76CCE1
SHA-256:	73B0B92179C61C26589B47E9732CE418B07EDEE3860EE5A2A5FB06F3B8AA9B26
SHA-512:	DD44C2D24D4E3A0F0B988AD3D04683B5CB128298043134649BBE33B2512CE0C9B1A8E7D893B9F66FBBCDD901E2B0646C4533FB6C0C8C4AFCB95A0EFB95D446F8
Malicious:	false
Preview:	9iH...}Z.4..f..... 8.j....\|.&X..e.F.*.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\storage.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	327432
Entropy (8bit):	7.99938831605763
Encrypted:	true
SSDEEP:	6144:oX44S90aTiB66x3Pl6nGV4bfD6wXPIZ9iBj0UeprGm2d7Tm:LkjYGsfGUc9iB4UeprKdnm
MD5:	7E8F4A764B981D5B82D1CC49D341E9C6
SHA1:	D9F0685A028FB219E1A6286AEFB7D6FCFC778B85
SHA-256:	0BD3AAC12623520C4E2031C8B96B4A154702F36F97F643158E91E987D317B480
SHA-512:	880E46504FCFB4B15B86B9D8087BA88E6C4950E433616EBB637799F42B081ABF6F07508943ECB1F786B2A89E751F5AE62D750BDCFFDDF535D600CF66EC44E926
Malicious:	false
Preview:	pT..!..W..G.J..a.).@.i..wpK.so@...5.=.^..Q.oy.=e@9.B...F..09u"3.. 0t..RDn_4d.....E...i......~...\|..fX_...Xf.p^......>a..$...e.6:7d.(a.A...=.).....{B.[...y%...i.Q.<..xt.X..H.. ..HF7g...I.3.{.n....L.y;i..s-....(5i...........J.5b7}..fK..HV..,...0.... ....n.w6PMl.......v."".v.......#..X.a....../...cC...i..l{>5n.._+.e.d'...}...[..../...D.t..GVp.zz......(...o......b...+`J.{....hS1G.^I..v&.jm.#u..1..Mg!.E..U.T.....6.2>...6.l.K.w"o..E..."K%{....z.7....<...,....]t.:.....[.Z.u...3X8.QI..j_.&..N..q.e.2...6.R.~..9.Bq..A.v.6.G..#y.....O....Z)G...w..E..k(....+..O..........Vg.2xC......O...jc.....z..~.P...q../.-.'.h.._.cj.=..B.x.Q9.pu.\|i4...i...;O...n.?.,. ....v?.5}.OY@.dG\|<.._[.69@.2..m..I..oP=...xrK.?............b..5....i&...l.c\b}..Q..O+.V.mJ.....pz....>F.......H...6$...d...\|m...N..1.R..B.i..........$....$........CY}..$....r.....H...8...li.....7 P......?h....R.iF..6...q(.@LI.s..+K.....?m..H....*. l..&<}....`\|.B....3.....I..o...u1..8i=.z.W..7

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	56
Entropy (8bit):	4.823079645651109
Encrypted:	false
SSDEEP:	3:oMty8WddSWAnPL4A:oMLW6WAnPL4A
MD5:	743A1D76D284D8E42E19061A3F13A723
SHA1:	D6BBE641CBAC7B46C0922F32DCC89F8F5B87F98C
SHA-256:	86093BF03032ACFCEF934A0D8363B66AAF4ADEE58015DA0172E13635B1DD1FE8
SHA-512:	DF687DCD985D1F6127624220083DFD93A39FEBCE02A869F4126787DF3724890ECC10FF18077BFDEF02FCC802440F3F83545E4DA4BD826DC84E59B26A105F6567
Malicious:	false
Preview:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

\Device\ConDrv Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	4.2989523990568035
Encrypted:	false
SSDEEP:	24:z3U3g4DO/0XZd3Wo3opQ5ZKBQFYVgt7ovrNOYlK:zEw4DBXZxo4ABV+SrUYE
MD5:	970EE6AEAB63008333D1D883327DA660
SHA1:	A71E19F66886B1888A183BA1777A23FABAE9822E
SHA-256:	D270D397EB3CF1173D25795834B240466EFEE213E11B1B31CDC101015AFFCAD9
SHA-512:	EB49AEE1B4524E6F15C08345A380D7D28DC845DEBA5408A7D034F2F7F5A652C8A2E2FF293BFB307DE87DCC2FAA111BA3BE8BEF9C4752A73DE1835DCD844D39BB
Malicious:	false
Preview:	Microsoft .NET Framework Assembly Registration Utility version 4.7.3056.0..for Microsoft .NET Framework version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....Syntax: RegAsm AssemblyName [Options]..Options:.. /unregister Unregister types.. /tlb[:FileName] Export the assembly to the specified type library.. and register it.. /regfile[:FileName] Generate a reg file with the specified name.. instead of registering the types. This option.. cannot be used with the /u or /tlb options.. /codebase Set the code base in the registry.. /registered Only refer to already registered type libraries.. /asmpath:Directory Look for assembly references here.. /nologo Prevents RegAsm from displaying logo.. /silent Silent mode. Prevents displaying of success messages.. /verbose Displays extra information..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.664479719371558
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Scan_00059010189_ ref. 004118379411_ pdf.exe
File size:	352256
MD5:	106117a9928b774aa6bbb657f275de53
SHA1:	208d61ecd30789fba2325a0e0f46bb63bdba5bd9
SHA256:	a5affcfc364530db52dd4fcf252187cc09968a7bb1f1149bb919fd339634468a
SHA512:	821b25876ccdf80a77714618766a0578898f6671755a1e399d1d5ab7302ceaa9d67b6ed37964dad27088996823c5bd2db312eb0fd5dc00123d294800797c24f1
SSDEEP:	6144:SiS9IvO+J0i2ttjKd4aOLlLFIbJU+M2ucUcjwxvHVZ0y1UCgVhjX5+:SEvO+l2ttKdpYLFI3XucMx/f0ymCuh
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'._.................L...........k... ........@.. ....................................@................................

File Icon


Icon Hash:	8e9ab2a29a8a82d4

Static PE Info

General
Entrypoint:	0x446b8e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FFA270C [Sat Jan 9 21:58:36 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x46b38	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x48000	0x10e24	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x44b94	0x44c00	False	0.983899147727	data	7.99662602027	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x48000	0x10e24	0x11000	False	0.09765625	data	4.29496295357	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x48130	0x10828	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0x58958	0x14	data
RT_VERSION	0x5896c	0x2cc	data
RT_MANIFEST	0x58c38	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright
Assembly Version	0.0.0.0
InternalName	Scan_00059010189_ ref. 004118379411_ pdf.exe
FileVersion	0.0.0.0
ProductVersion	0.0.0.0
FileDescription
OriginalFilename	Scan_00059010189_ ref. 004118379411_ pdf.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2021 08:25:30.821877003 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:30.999865055 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:31.001878977 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:31.047482014 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:31.235569000 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:31.235827923 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:31.463349104 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:31.465738058 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:31.644119978 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:31.701517105 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:31.864511967 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.092422009 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.101799965 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.101877928 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.101939917 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.101984978 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102025032 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102041006 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.102072954 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.102082014 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102135897 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.102139950 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102194071 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102240086 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102243900 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.102302074 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.102354050 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.279844999 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.279941082 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.279968977 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.279994965 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280020952 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280040026 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280044079 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280065060 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280083895 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280095100 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280105114 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280119896 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280131102 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280153990 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280167103 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280178070 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280205011 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280220032 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280227900 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280241966 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280256033 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280284882 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280287027 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280312061 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280335903 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280350924 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280358076 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280385017 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.280401945 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.280440092 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458045959 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458072901 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458096027 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458122969 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458148956 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458178043 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458201885 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458203077 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458224058 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458240032 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458254099 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458282948 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458302975 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458307028 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458340883 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458347082 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458365917 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458394051 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458394051 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458415985 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458444118 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458446026 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458468914 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458494902 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458497047 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458518982 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458549023 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458550930 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458575964 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458604097 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458605051 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458626986 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458656073 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458657026 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458678007 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458704948 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458713055 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458729029 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458760023 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458765984 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458787918 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458815098 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458841085 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458868980 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458889961 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458901882 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458920956 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458954096 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.458967924 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.458988905 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459012032 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.459019899 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459053040 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459076881 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.459080935 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459103107 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459130049 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.459136963 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.459314108 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.636620998 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636660099 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636683941 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636710882 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636733055 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636755943 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636776924 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636797905 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636822939 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636838913 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.636847019 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636871099 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636892080 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.636900902 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.636902094 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636919975 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.636930943 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636955976 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636979103 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.636986017 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637001991 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637023926 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637023926 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637048960 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637072086 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637099028 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637104034 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637124062 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637125969 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637150049 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637173891 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637176991 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637188911 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637197018 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637219906 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637240887 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637264013 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637293100 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637317896 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637433052 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637433052 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637455940 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637478113 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637499094 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637511969 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637523890 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637525082 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637531042 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637535095 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637550116 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637571096 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637583971 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637594938 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637620926 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637624979 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637641907 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637664080 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637667894 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637686968 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637706041 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637712955 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637737036 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637758970 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637764931 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637784004 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637804031 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637808084 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637830973 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637862921 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.637907028 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.637960911 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815331936 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815361977 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815376997 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815393925 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815412045 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815428972 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815445900 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815463066 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815479994 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815493107 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815505981 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815522909 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815541983 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815561056 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815572023 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815578938 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815596104 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815613985 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815617085 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815623045 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815628052 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815632105 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815649986 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815659046 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815669060 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815690994 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815704107 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815711021 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815730095 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815728903 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815747976 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815766096 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815778017 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815783978 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815802097 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815817118 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815819979 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:32.815831900 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.815885067 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:32.993464947 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:33.170341969 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:33.344469070 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:33.344620943 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:33.905016899 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:33.951200962 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.082711935 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.082815886 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.181226969 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.260566950 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.260627031 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.260739088 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.439429045 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.439486027 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.439523935 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.439598083 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.617353916 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.617376089 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.617424011 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.617439985 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.617549896 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.795166969 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.795181990 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.795202971 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.795214891 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.795227051 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.795348883 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.795393944 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.921170950 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.973612070 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.973630905 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.973978043 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.975573063 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.975589037 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.975600958 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.975625992 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:34.975673914 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:34.975716114 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.150461912 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.151437998 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.151566982 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.152719975 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.153376102 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.153512955 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.153525114 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.153546095 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.153609991 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.153651953 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.330154896 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330177069 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330203056 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330307961 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.330835104 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330852985 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330877066 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330915928 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.330938101 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.330955029 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.467410088 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.507649899 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.507667065 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.507689953 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.507857084 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.508795977 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.508810043 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.508833885 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.508846998 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.508969069 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.509008884 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.644922018 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.645159006 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.685375929 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.685580969 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.685601950 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.685617924 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.685731888 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.686537027 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.686561108 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.686671972 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.686942101 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.686981916 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.687140942 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.822663069 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.863742113 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.863748074 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.863770962 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.863784075 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.863851070 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.863882065 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.865320921 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.865345001 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.865361929 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.865376949 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.865411043 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:35.865417004 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.865438938 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.865446091 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:35.921497107 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.044092894 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.044132948 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.044186115 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.044214964 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.044229031 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.044253111 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.044267893 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.044296026 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.044317961 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.046576023 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046617985 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046654940 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046693087 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046700001 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.046726942 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.046735048 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046739101 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.046758890 CET	7008	49714	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:36.046789885 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:36.046809912 CET	49714	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:37.937987089 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.116020918 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.116197109 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.116731882 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.310117006 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.310385942 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.488533974 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.489757061 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.716455936 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716491938 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716515064 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716538906 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716562033 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716584921 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716607094 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716615915 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.716628075 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716654062 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716671944 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.716675997 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.716723919 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894586086 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894618988 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894638062 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894658089 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894678116 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894701004 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894722939 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894743919 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894767046 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894779921 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894790888 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894812107 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894814014 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894819975 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894833088 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894846916 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894855022 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894881010 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894893885 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894902945 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894925117 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.894928932 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.894979000 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.895621061 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.895648956 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.895673990 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.895698071 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:38.895777941 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:38.921747923 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072387934 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072423935 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072448969 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072470903 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072494030 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072503090 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072518110 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072530985 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072542906 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072552919 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072570086 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072590113 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072594881 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072618008 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072618961 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072638988 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072650909 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072662115 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072670937 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072683096 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072693110 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072705030 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072716951 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072729111 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072736025 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072752953 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072760105 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072773933 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072778940 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072793961 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072801113 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072813034 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072818041 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072833061 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072838068 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072856903 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072870016 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072876930 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072891951 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072896957 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072920084 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072922945 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072943926 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072954893 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.072963953 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072983027 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.072985888 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073004007 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073014975 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073024988 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073045015 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073048115 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073070049 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073075056 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073093891 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073102951 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073118925 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073127031 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073139906 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073148012 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073160887 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073168993 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073184967 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073191881 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073206902 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073214054 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073227882 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073235035 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073249102 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073265076 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073271036 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.073287964 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.073322058 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.148874044 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254364014 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254400969 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254422903 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254465103 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254487038 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254508972 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254540920 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254556894 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254556894 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254579067 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254600048 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254621029 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254642010 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254662991 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254668951 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254673004 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254689932 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254710913 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254719973 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254734993 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254756927 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254767895 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254777908 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254800081 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254820108 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254834890 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254841089 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254863024 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254870892 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254884958 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254909992 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254931927 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254939079 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254945993 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.254954100 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254976034 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254997969 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.254998922 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255017996 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255023003 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255042076 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255059958 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255069971 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255081892 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255103111 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255110025 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255124092 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255145073 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255166054 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255168915 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255189896 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255207062 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255213976 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255234957 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255255938 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255258083 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255278111 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255292892 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255299091 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255319118 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255328894 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255340099 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255359888 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255371094 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255393982 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255415916 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255415916 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255436897 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255459070 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.255464077 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.255502939 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433007956 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433083057 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433140993 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433213949 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433227062 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433243990 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433305025 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433320999 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433362007 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433379889 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433454990 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433496952 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433523893 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433533907 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433577061 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433583975 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433626890 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433669090 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433682919 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433706045 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433743954 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433758974 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433780909 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433818102 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433830976 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433849096 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433886051 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433923960 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433933973 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.433963060 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.433984995 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434000015 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434037924 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434084892 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434113979 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434123039 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434159994 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434196949 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434196949 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434222937 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434243917 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434290886 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434303999 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434326887 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434365988 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434403896 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434423923 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434439898 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434468031 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434500933 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434542894 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434581041 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434618950 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434632063 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434653997 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434683084 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434684992 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434727907 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434737921 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434751987 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434792042 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434813976 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434817076 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434855938 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434861898 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434892893 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434912920 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.434941053 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.434983015 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.435020924 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.435045004 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.435079098 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612417936 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612462997 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612500906 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612570047 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612607956 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612607956 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612627029 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612647057 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612684011 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612713099 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612721920 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612757921 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612790108 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612796068 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612833023 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612854958 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612879038 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612920046 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612957001 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.612979889 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.612993002 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613013983 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613030910 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613173008 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613229990 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613241911 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613267899 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613293886 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613305092 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613343000 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613390923 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613426924 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613476992 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613521099 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613547087 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613559961 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613573074 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613596916 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613636017 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613672018 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613682032 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613711119 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613733053 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613748074 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613794088 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613795996 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613836050 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613873005 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613913059 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613923073 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613950968 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.613964081 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.613987923 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614026070 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614063025 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614083052 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614110947 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614123106 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614154100 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614192009 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614232063 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614258051 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614269972 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614298105 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614305019 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614342928 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614355087 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614382029 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614430904 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.614434958 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.614500046 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.616756916 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792655945 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792687893 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792711973 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792735100 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792757034 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792778015 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792798996 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792820930 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792840004 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792845011 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792861938 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792874098 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792884111 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792895079 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792906046 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792927027 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792948008 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792962074 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792968035 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792979002 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.792993069 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.792999983 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793015957 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793035984 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793036938 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793059111 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793081045 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793087959 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793101072 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793123960 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793123960 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793144941 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793164968 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793169022 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793190956 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793211937 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793219090 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793232918 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793253899 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793257952 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793276072 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793297052 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793298006 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793317080 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793338060 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793340921 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793363094 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793389082 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793399096 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793421030 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793442011 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793459892 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.793463945 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.793509007 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.794086933 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794110060 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794131994 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794156075 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794167995 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.794179916 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794194937 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.794200897 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794223070 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794236898 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.794243097 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794264078 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.794271946 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.794308901 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.795501947 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.795536995 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.795622110 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.922254086 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971050978 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971101999 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971149921 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971191883 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971211910 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971229076 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971246004 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971252918 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971257925 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971266985 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971271992 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971303940 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971330881 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971339941 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971359015 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:39.971369982 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:39.971405983 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:40.151176929 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:40.170964003 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:40.608998060 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:40.836507082 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:40.948690891 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:41.012226105 CET	7008	49721	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:41.014718056 CET	49721	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:42.969341993 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:43.147105932 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:43.147232056 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:43.147919893 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:43.334708929 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:43.335015059 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:43.512656927 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:43.545104027 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:43.773264885 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:43.855592012 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:43.923163891 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:44.101087093 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:44.101197004 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:44.330210924 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:44.330310106 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:44.508348942 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:44.523283005 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:44.702342987 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:44.703660965 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:44.931946993 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:44.969014883 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:45.197441101 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:45.790677071 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:45.937463045 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:46.018213034 CET	7008	49727	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:46.018291950 CET	49727	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:47.953819990 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.133089066 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:48.133311033 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.133879900 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.320962906 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:48.321319103 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.500375986 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:48.546590090 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.724350929 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:48.725465059 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:48.953627110 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:48.985641956 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:49.062284946 CET	7008	49729	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:49.062402964 CET	49729	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.001645088 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.181415081 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:51.181560040 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.210213900 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.399976015 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:51.400118113 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.633060932 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:51.635575056 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:51.813457012 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:51.825361967 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:52.053443909 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:52.152767897 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:52.161566019 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:52.339689016 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:52.341716051 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:52.569902897 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:52.569994926 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:52.751507044 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:52.796942949 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:52.974427938 CET	7008	49730	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:53.015923023 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:53.235049963 CET	49730	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:55.251485109 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:55.429564953 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:55.429656982 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:55.434613943 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:55.624161005 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:55.640177965 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:55.818191051 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:55.819377899 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:56.048361063 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.137152910 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.138302088 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:56.316160917 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.316291094 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:56.526563883 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.526828051 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:56.704464912 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.751976967 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:56.929867029 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:56.945825100 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:57.174798965 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:57.220009089 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:25:57.447155952 CET	7008	49731	185.244.38.210	192.168.2.5
Jan 10, 2021 08:25:58.237435102 CET	49731	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:00.252604961 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:00.430155993 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:00.430270910 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:00.439030886 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:00.626686096 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:00.627073050 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:00.805002928 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:00.806622982 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:01.034353971 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.121953964 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.123235941 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:01.300750971 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.300858974 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:01.530849934 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.531044006 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:01.708584070 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.750855923 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:01.928498030 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:01.969600916 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:02.236172915 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:02.464478970 CET	7008	49733	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:03.236073971 CET	49733	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.255091906 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.432614088 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:05.432706118 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.498070955 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.685544968 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:05.696146011 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.874502897 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:05.939752102 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:05.963788033 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:06.192636967 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:06.279073954 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:06.291858912 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:06.469624043 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:06.470040083 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:06.698626995 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:06.704914093 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:06.882781982 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:06.938766003 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:07.031702042 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:07.209479094 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:07.251264095 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:07.368786097 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:07.596800089 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:07.596960068 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:07.825083017 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:08.554908037 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:08.782661915 CET	7008	49740	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:09.540651083 CET	49740	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:11.550267935 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:11.728275061 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:11.728396893 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:11.730225086 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:11.920542002 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:11.920962095 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.098640919 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.142270088 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.166100979 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.393886089 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.483237028 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.532915115 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.550103903 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.710454941 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.711091995 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.778203964 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.778646946 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.938663960 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:12.938812971 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:12.956598997 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:13.001720905 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:13.117008924 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:13.158241987 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:13.576443911 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:13.580708027 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:13.809263945 CET	7008	49743	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:14.581068039 CET	49743	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:16.610744953 CET	49744	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:16.788536072 CET	7008	49744	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:16.788786888 CET	49744	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:16.804811001 CET	49744	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:16.983325005 CET	7008	49744	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:19.004093885 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:19.185426950 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:19.188224077 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:19.211441994 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:19.397911072 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:19.398596048 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:19.589860916 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:19.590137959 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:19.822482109 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:19.822704077 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:20.053761959 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:20.151448011 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:20.165297985 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:20.343483925 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:20.344902992 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:20.536906004 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:20.537085056 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:20.730794907 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:20.732022047 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:20.960314989 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:21.581068993 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:21.755517006 CET	7008	49745	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:21.755664110 CET	49745	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:23.598642111 CET	49746	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:23.776356936 CET	7008	49746	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:23.777015924 CET	49746	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:23.777790070 CET	49746	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:23.955487013 CET	7008	49746	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:25.973782063 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.151371002 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:26.151670933 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.153197050 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.370954037 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:26.376534939 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.554267883 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:26.582511902 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.760227919 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:26.761399984 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:26.988960028 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:27.131103992 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:27.133306980 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:27.311650038 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:27.313225031 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:27.491305113 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:27.491400003 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:27.583111048 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:27.669955969 CET	7008	49747	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:27.670030117 CET	49747	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:29.612901926 CET	49748	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:32.612776041 CET	49748	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:32.790313005 CET	7008	49748	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:32.790631056 CET	49748	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:32.791896105 CET	49748	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:32.969611883 CET	7008	49748	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:34.974078894 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.151773930 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.152076006 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.152800083 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.343014002 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.343552113 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.521557093 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.526006937 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.754014015 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.754230022 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.852125883 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.895298004 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:35.932297945 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:35.932523966 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:36.161989927 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:36.162245035 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:36.340060949 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:36.394819021 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:36.572550058 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:36.594461918 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:36.822051048 CET	7008	49749	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:37.583313942 CET	49749	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:39.598962069 CET	49750	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:39.776397943 CET	7008	49750	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:39.776527882 CET	49750	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:39.812263012 CET	49750	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:39.990056038 CET	7008	49750	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:42.006915092 CET	49751	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:42.193236113 CET	7008	49751	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:42.193382978 CET	49751	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:42.194545031 CET	49751	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:42.372101068 CET	7008	49751	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:53.523480892 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:53.701122999 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:53.701246023 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:53.707190037 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:53.893321991 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:53.893399954 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:54.120846987 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:54.121150017 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:54.298790932 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:54.304052114 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:54.531954050 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:54.652229071 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:54.653459072 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:54.831087112 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:54.831219912 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:55.059132099 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:55.059287071 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:55.236948967 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:55.286449909 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:55.464550018 CET	7008	49755	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:55.505436897 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:55.756413937 CET	49755	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:57.772783995 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:57.950351000 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:57.950483084 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:57.951013088 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:58.137031078 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:58.137376070 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:58.314927101 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:58.316669941 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:58.546236992 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:58.636693954 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:58.638479948 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:58.816051960 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:58.816206932 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:59.044713974 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:59.045372009 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:59.223277092 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:59.271320105 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:59.449295044 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:26:59.506184101 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:26:59.772444963 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:00.001533985 CET	7008	49756	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:00.772089958 CET	49756	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:02.790051937 CET	49757	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:02.967538118 CET	7008	49757	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:02.967789888 CET	49757	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:02.968926907 CET	49757	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:03.146359921 CET	7008	49757	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:05.228029013 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:05.405497074 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:05.405740976 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:05.406466961 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:05.593292952 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:05.626384974 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:05.803944111 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:05.804203987 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:06.030939102 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.031250000 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:06.258795977 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.339401960 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.341630936 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:06.519640923 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.522124052 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:06.699593067 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.699738026 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:06.877185106 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:06.877284050 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:07.104825020 CET	7008	49758	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:07.788305998 CET	49758	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:09.805713892 CET	49759	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:09.983319044 CET	7008	49759	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:09.984205008 CET	49759	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:09.984239101 CET	49759	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:10.162312984 CET	7008	49759	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:12.183505058 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:12.361001015 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:12.361505985 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:12.361814976 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:12.589660883 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:12.872139931 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:12.872700930 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:13.050482988 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:13.053539038 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:13.367974043 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:13.368268013 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:13.637155056 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:13.638364077 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:13.815718889 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:13.817065001 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:13.994678020 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:13.995193958 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:14.173505068 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:14.173702002 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:14.467892885 CET	7008	49760	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:15.148288012 CET	49760	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:17.165610075 CET	49761	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:17.343317032 CET	7008	49761	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:17.343539953 CET	49761	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:17.353864908 CET	49761	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:17.531868935 CET	7008	49761	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:19.554364920 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:19.732295990 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:19.732412100 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:19.733942986 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:19.948935986 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:19.991651058 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:20.169591904 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:20.170243025 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:20.348140001 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:20.348418951 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:20.638125896 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:20.638195992 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:20.937333107 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:21.043123007 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:21.044194937 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:21.180264950 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:21.222172022 CET	7008	49762	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:21.223216057 CET	49762	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:23.205482006 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:23.383399963 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:23.383533001 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:23.387264013 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:23.572865009 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:23.573312998 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:23.751085043 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:23.753807068 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:24.067898989 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:24.195785046 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:24.253878117 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:24.305864096 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:24.485306978 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:24.485492945 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:24.663605928 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:24.665646076 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:24.843686104 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:24.847553015 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:25.025527000 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:25.070147991 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:25.195903063 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:25.467407942 CET	7008	49763	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:26.180228949 CET	49763	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:28.200005054 CET	49764	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:28.379375935 CET	7008	49764	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:28.382374048 CET	49764	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:28.383228064 CET	49764	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:28.561678886 CET	7008	49764	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:30.571882010 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:30.750086069 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:30.751266003 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:30.751789093 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:30.941245079 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:30.941618919 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.119452953 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.121184111 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.349380970 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.352045059 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.434237957 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.476975918 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.529900074 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.531303883 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.759119034 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.759277105 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:31.936724901 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:31.977109909 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:32.154740095 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:32.211359024 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:32.233634949 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:32.461646080 CET	7008	49765	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:33.243340969 CET	49765	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:35.259941101 CET	49766	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:35.437613964 CET	7008	49766	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:35.437736034 CET	49766	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:35.439084053 CET	49766	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:35.616837025 CET	7008	49766	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:37.636159897 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:37.813893080 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:37.813993931 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:37.818429947 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.018774033 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.020404100 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.202852011 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.208502054 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.436939955 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.437246084 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.529975891 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.586874008 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.614942074 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.615689039 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:38.844964027 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:38.845122099 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:39.023061991 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:39.071320057 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:39.244863033 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:39.255211115 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:39.305701971 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:39.471893072 CET	7008	49767	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:40.228257895 CET	49767	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:42.246143103 CET	49768	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:42.423809052 CET	7008	49768	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:42.425182104 CET	49768	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:42.426469088 CET	49768	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:42.604437113 CET	7008	49768	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:44.638343096 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:44.816063881 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:44.818839073 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:44.819936037 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.006726980 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.009352922 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.188134909 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.206031084 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.434098959 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.436573029 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.527482986 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.574640036 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.614541054 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.614746094 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:45.842166901 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:45.842498064 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:46.020687103 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:46.077490091 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:46.256313086 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:46.304847956 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:46.398004055 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:46.625847101 CET	7008	49769	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:47.387376070 CET	49769	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:49.402425051 CET	49773	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:49.579849005 CET	7008	49773	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:49.583770990 CET	49773	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:49.584348917 CET	49773	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:49.761816025 CET	7008	49773	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:51.781265020 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:51.958914042 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:51.960488081 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:51.961256981 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:52.150023937 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.154186010 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:52.332285881 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.335511923 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:52.563085079 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.563273907 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:52.670304060 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.741292000 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.741436005 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:52.919429064 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:52.922202110 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:53.150979996 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:53.151699066 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:53.329682112 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:53.421456099 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:53.531127930 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:53.599231005 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:53.733413935 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:53.759500027 CET	7008	49777	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:54.547100067 CET	49777	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:56.563147068 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:56.740712881 CET	7008	49782	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:56.740835905 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:56.741497993 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:56.927855015 CET	7008	49782	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:56.930531979 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:57.108597040 CET	7008	49782	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:57.110023975 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:57.287767887 CET	7008	49782	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:57.327410936 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:57.505620003 CET	7008	49782	185.244.38.210	192.168.2.5
Jan 10, 2021 08:27:57.508157015 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:27:57.546716928 CET	49782	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:00.491889954 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:00.669799089 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:00.669910908 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:00.670459986 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:00.859600067 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:00.860832930 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:01.038757086 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:01.042613029 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:01.270473957 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:01.355878115 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:01.356795073 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:01.534337044 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:01.535595894 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:01.763324976 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:01.763417959 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:01.941693068 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:02.030935049 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:02.209019899 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:02.328016043 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:02.486005068 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:02.715017080 CET	7008	49783	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:03.531641960 CET	49783	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:05.548028946 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:05.725538969 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:05.727121115 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:05.727600098 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:05.913836002 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:05.914341927 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:06.092056990 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:06.140908003 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:06.319009066 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:06.322350979 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:06.549634933 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:06.667542934 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:06.668044090 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:06.845659971 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:06.850213051 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:07.028031111 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:07.028203964 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:07.205857992 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:07.250138998 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:08.961111069 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:09.016027927 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:10.927824974 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:10.969183922 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:15.972486019 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:16.016444921 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:17.958126068 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:18.001106024 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:20.973077059 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:21.016854048 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:25.973582983 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:26.017364025 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:26.195086002 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:26.236131907 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:30.974438906 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:31.017864943 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:34.011961937 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:34.065038919 CET	49784	7008	192.168.2.5	185.244.38.210
Jan 10, 2021 08:28:35.975296974 CET	7008	49784	185.244.38.210	192.168.2.5
Jan 10, 2021 08:28:36.018131971 CET	49784	7008	192.168.2.5	185.244.38.210

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532 Parent PID: 5584

General

Start time:	08:25:16
Start date:	10/01/2021
Path:	C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Scan_00059010189_ ref. 004118379411_ pdf.exe'
Imagebase:	0x760000
File size:	352256 bytes
MD5 hash:	106117A9928B774AA6BBB657F275DE53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000002.233831964.0000000003A04000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 5764 Parent PID: 4532

General

Start time:	08:25:17
Start date:	10/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Imagebase:	0x7f0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: schtasks.exe PID: 4392 Parent PID: 5764

General

Start time:	08:25:22
Start date:	10/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmpE5CB.tmp'
Imagebase:	0x390000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 408 Parent PID: 4392

General

Start time:	08:25:28
Start date:	10/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5436 Parent PID: 5764

General

Start time:	08:25:29
Start date:	10/01/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp606.tmp'
Imagebase:	0x390000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 3536 Parent PID: 5436

General

Start time:	08:25:29
Start date:	10/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegAsm.exe PID: 6028 Parent PID: 904

General

Start time:	08:25:30
Start date:	10/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 0
Imagebase:	0x7ff797770000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 4944 Parent PID: 6028

General

Start time:	08:25:31
Start date:	10/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 4948 Parent PID: 904

General

Start time:	08:25:31
Start date:	10/01/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0x7c0000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 5352 Parent PID: 4948

General

Start time:	08:25:31
Start date:	10/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 5644 Parent PID: 3472

General

Start time:	08:25:33
Start date:	10/01/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0xe90000
File size:	64616 bytes
MD5 hash:	6FD7592411112729BF6B1F2F6C34899F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 1624 Parent PID: 5644

General

Start time:	08:25:34
Start date:	10/01/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Scan_00059010189_ ref. 004118379411_ pdf.exe PID: 4532 Parent PID: 5584 Scan_00059010189_ ref. 004118379411_ pdf.exeCOMMON

Executed Functions

Function 01117EBD, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 325processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0111818F

Strings

5H, xrefs: 01117F03
5H, xrefs: 01117F32

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: CreateProcess
String ID: 5H$5H
API String ID: 963392458-1752349424
Opcode ID: 0758ab9d6ee468434c432992c9ca75ad4fda14d5147c17947fa48084d3e33e0d
Instruction ID: 7f9f71e2d336f2a8bfe8ef9612fe1ca771bb500987d5251b2ef4eddaae7f795f
Opcode Fuzzy Hash: 0758ab9d6ee468434c432992c9ca75ad4fda14d5147c17947fa48084d3e33e0d
Instruction Fuzzy Hash: BEC13571D0026D8FDF24DFA8C880BEEBBB1BB49314F0085A9E519B7244DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01117EC8, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 321processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0111818F

Strings

5H, xrefs: 01117F03
5H, xrefs: 01117F32

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: CreateProcess
String ID: 5H$5H
API String ID: 963392458-1752349424
Opcode ID: 212ed3348d2d41f857429dde314c919017335be7fc4c3d7ccd9809684fb65069
Instruction ID: 8a3b9ca8727f6b03bcbb629fabe37197bb7647ed2f95b301105d3d89aff9d3f4
Opcode Fuzzy Hash: 212ed3348d2d41f857429dde314c919017335be7fc4c3d7ccd9809684fb65069
Instruction Fuzzy Hash: 89C12571D0026D8FDF24DFA8C880BEEBBB1BB49314F0085A9E519B7244DB749A85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01117AA8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 120injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01117B83

Strings

5H, xrefs: 01117AD2

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: 5H
API String ID: 3559483778-216627897
Opcode ID: 47dcd5bb8774bc8932372c627b7098b0741fa0e32ec9ab83b1cae4f0869a1a18
Instruction ID: 6b82ac4c5c81b02cd9acf40631f63cf905b2591556fdfd8b4d8281af030caa1e
Opcode Fuzzy Hash: 47dcd5bb8774bc8932372c627b7098b0741fa0e32ec9ab83b1cae4f0869a1a18
Instruction Fuzzy Hash: C641A9B5D042589FCF04CFA9D984AEEFBF1BB49314F14902AE918B7240D739AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01117AB0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01117B83

Strings

5H, xrefs: 01117AD2

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: 5H
API String ID: 3559483778-216627897
Opcode ID: 8fd3f3e7fe442483852f50968c084c9fa9bbb8c6167d3319bc96b7c101647dbd
Instruction ID: 6404bb0afffcc4becce73f08e383ea19ca6385a77d7d3b1956f0fc015c2595b6
Opcode Fuzzy Hash: 8fd3f3e7fe442483852f50968c084c9fa9bbb8c6167d3319bc96b7c101647dbd
Instruction Fuzzy Hash: 494188B5D052589FCF04CFA9D984AEEFBF1BB49314F14902AE918B7240D738AA45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01117C30, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01117CEA

Strings

5H, xrefs: 01117C5A

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: 5H
API String ID: 1726664587-216627897
Opcode ID: de3fd2084209c9c7ed0a7ceb9d96d393413226e7e10fa91ae62e45e6fe275e4f
Instruction ID: 0fa9b74287afe003731bf7cb9c3f1820d22bdaa457d8862535a46764d1b69b5a
Opcode Fuzzy Hash: de3fd2084209c9c7ed0a7ceb9d96d393413226e7e10fa91ae62e45e6fe275e4f
Instruction Fuzzy Hash: 6141A9B5D042589FCF14CFA9D980AEEFBB1BB09310F14902AE915B7340D735A946CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01117C38, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01117CEA

Strings

5H, xrefs: 01117C5A

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: 5H
API String ID: 1726664587-216627897
Opcode ID: 950aa40abf3e9d45a4e904dbac78fea582dcb8d4a1c22b0f9a22333b1cd48d7d
Instruction ID: 9adb34f1e6b437955b5f7424a5b9ec29c79284e8cc295128498ed6610ba5258e
Opcode Fuzzy Hash: 950aa40abf3e9d45a4e904dbac78fea582dcb8d4a1c22b0f9a22333b1cd48d7d
Instruction Fuzzy Hash: 6341A8B5D042589FCF14CFAAD980AEEFBB1BB09310F10A02AE815B7340D735A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01117928, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 011179DA

Strings

5H, xrefs: 0111794A

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: 5H
API String ID: 4275171209-216627897
Opcode ID: ffa4209f26cb526d3f867ed631fa2c3ae827ed6942aaf96e62e9be2fa5eda331
Instruction ID: 423db01d5731cc08ac081618e15b0af90a57b9348cb77ead5ac12cfdb400803a
Opcode Fuzzy Hash: ffa4209f26cb526d3f867ed631fa2c3ae827ed6942aaf96e62e9be2fa5eda331
Instruction Fuzzy Hash: 8F31A9B9D042989FCF14CFA9D980ADEFBB1BB49310F10902AE915B7340D735A946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01117930, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 011179DA

Strings

5H, xrefs: 0111794A

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: 5H
API String ID: 4275171209-216627897
Opcode ID: 84c7e6b01710c999af1313f4327faffbaad4196a43ba5e40859bfe48f2777cb8
Instruction ID: ca68fac8dcc7c31ef99a1eba702644a075811cbffd9e697466169cc62841c573
Opcode Fuzzy Hash: 84c7e6b01710c999af1313f4327faffbaad4196a43ba5e40859bfe48f2777cb8
Instruction Fuzzy Hash: CE3198B9D042589FCF14CFA9D980ADEFBB1BB49310F10902AE915B7300D735A946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 01117740, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 011177F7

Strings

5H, xrefs: 01117767

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: ContextThread
String ID: 5H
API String ID: 1591575202-216627897
Opcode ID: ac9cf5c94150682fee73748ae957e9c44dc39104eb13f5603064a535063ccba8
Instruction ID: a61073d88cf53d668dbf0660a2f192fccbf75d57a967e0a2f49034d81ffe21b6
Opcode Fuzzy Hash: ac9cf5c94150682fee73748ae957e9c44dc39104eb13f5603064a535063ccba8
Instruction Fuzzy Hash: 7541CBB4D002589FDB14CFA9D984AEEFBF1AF49314F14802AE415B7340D738A945CF64

Uniqueness

Uniqueness Score: -1.00%

Function 01117748, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 94threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 011177F7

Strings

5H, xrefs: 01117767

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: ContextThread
String ID: 5H
API String ID: 1591575202-216627897
Opcode ID: c33914f79d6f94b6c6d7482485c2f3d1b52a28718bc0cd102a1715ee22a7a7da
Instruction ID: 7789abe70decab3075b7b8309cf5fe3d3a9f2a69cfaedc5a50651e55010fc7a7
Opcode Fuzzy Hash: c33914f79d6f94b6c6d7482485c2f3d1b52a28718bc0cd102a1715ee22a7a7da
Instruction Fuzzy Hash: D631BAB4D002589FCB14CFAAD984AEEFBF1AB49314F14802AE414B7340D738A949CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01117621, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 011176A6

Strings

5H, xrefs: 01117642

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: ResumeThread
String ID: 5H
API String ID: 947044025-216627897
Opcode ID: 30c3cf44232f8653e3bca531cc2814126b2f86c335aa934a01dafbb413a42814
Instruction ID: d1ff0209fe1b764e664dd08153748c685aaeb43a50b8b3ccbbd53400dbad4b15
Opcode Fuzzy Hash: 30c3cf44232f8653e3bca531cc2814126b2f86c335aa934a01dafbb413a42814
Instruction Fuzzy Hash: 1C31CAB4D002589FDF14CFAAD980AEEFBB0AF49314F14942AE815B7340DB35A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01117628, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 011176A6

Strings

5H, xrefs: 01117642

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID: ResumeThread
String ID: 5H
API String ID: 947044025-216627897
Opcode ID: 8c9f31b2cce60a74de52c0f452048209cfa0cdb0e6daf74ae53dfef23bd3db8c
Instruction ID: a9d363ff82da9af72157ece2a9c7a5618f8a17eb649495723b3272b46d2c4ea6
Opcode Fuzzy Hash: 8c9f31b2cce60a74de52c0f452048209cfa0cdb0e6daf74ae53dfef23bd3db8c
Instruction Fuzzy Hash: A331D9B4D002589FDF14CFAAD980AEEFBB4AF49314F14942AE814B7300DB34A905CFA4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01111811, Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

w, xrefs: 0111193E

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: f09d251857fbd8783507895b80c8d1ebc57f06a4e843ddf1ab638c14b3445e17
Instruction ID: 27e46522be74069cbb6a4b50f6286cfa54d30f603917c49af7291ed935e2519c
Opcode Fuzzy Hash: f09d251857fbd8783507895b80c8d1ebc57f06a4e843ddf1ab638c14b3445e17
Instruction Fuzzy Hash: 3E413FB1E156188BEB5CCF6B8D4039EFAF7AFC8200F14C1BAD91CA6259EB3045468F55

Uniqueness

Uniqueness Score: -1.00%

Function 01111820, Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

w, xrefs: 0111193E

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: d41e37286524883d644d15bbd97e4aaf75b9d4727ec20b169cdfafb803d3049e
Instruction ID: ca3f80b4592471dc396fe1960882974d0f0101e39e5289ac06a7de5094d02d51
Opcode Fuzzy Hash: d41e37286524883d644d15bbd97e4aaf75b9d4727ec20b169cdfafb803d3049e
Instruction Fuzzy Hash: B24120B1E156188BEB5CCF6B8D4078EFAF7AFC8200F14D1BAD51CA6259DB3005468F55

Uniqueness

Uniqueness Score: -1.00%

Function 01110682, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e731df72e85d3ab1362075f1c31d94a6423abd063db42f306a93d1f21f2d54
Instruction ID: dafdc9cca6e569551637bc2d2adad7598303f8dcae5788848dbd757abb5f8fa6
Opcode Fuzzy Hash: 54e731df72e85d3ab1362075f1c31d94a6423abd063db42f306a93d1f21f2d54
Instruction Fuzzy Hash: 7291D930F043188BDB5C9F75986467EBAB7AFCD315B06882DE40AE7789EF3488458752

Uniqueness

Uniqueness Score: -1.00%

Function 011115B1, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7597c5c4b3a5c1a40481800b0030403b4fa347c1c1482aca73d275ecfdf5168
Instruction ID: afeed42035a7e9e46fe0a4359f9d975bc5c8ad3245d35ed06ee1853330df423d
Opcode Fuzzy Hash: b7597c5c4b3a5c1a40481800b0030403b4fa347c1c1482aca73d275ecfdf5168
Instruction Fuzzy Hash: 30517570D042898FDB54EF76D89079EBBF2FB89304F05C929D204AB268EF74594A8F51

Uniqueness

Uniqueness Score: -1.00%

Function 011115C0, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.233589517.0000000001110000.00000040.00000001.sdmp, Offset: 01110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ade872ab2da66eb859323f057a384f97b3d81db37877b1a5395a9e3047fb8d3
Instruction ID: 8c2d6c92b191d33540962cf9d018542b7b8823bcf349ab59b20b456511b4714f
Opcode Fuzzy Hash: 9ade872ab2da66eb859323f057a384f97b3d81db37877b1a5395a9e3047fb8d3
Instruction Fuzzy Hash: 80516670D042898FDB54DF76D89079DBBF2EB89304F05C939D204AB268EF74594A8F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 6028 Parent PID: 904 RegAsm.exeCOMMON

Executed Functions

Function 0127189D, Relevance: 1.7, APIs: 1, Instructions: 169COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,?,?,?,00000000,00000000), ref: 01271A4B

Memory Dump Source

Source File: 00000008.00000002.268660135.0000000001270000.00000040.00000001.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 7b7554dc94b018375978824e9664197d531c1f0f619841d4068a46ffa3130935
Instruction ID: 6bf2e2610015c73f1e83564c16deaa139f23a85e5114cf188d4bd896e0ad0a27
Opcode Fuzzy Hash: 7b7554dc94b018375978824e9664197d531c1f0f619841d4068a46ffa3130935
Instruction Fuzzy Hash: FE712370D10219DFDB24CFA9C98469EBBF1BF48314F25812AE919AB350DB34A946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012718A8, Relevance: 1.7, APIs: 1, Instructions: 165COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,?,?,?,00000000,00000000), ref: 01271A4B

Memory Dump Source

Source File: 00000008.00000002.268660135.0000000001270000.00000040.00000001.sdmp, Offset: 01270000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: d52adc5dc3d4755310971a672b74e450c03e58b8ed879655392b109f5d3885e8
Instruction ID: 81d0ff96e02dd1de18ccfe5a119da9f023e5f240de172ad08ffd52d6d3de785a
Opcode Fuzzy Hash: d52adc5dc3d4755310971a672b74e450c03e58b8ed879655392b109f5d3885e8
Instruction Fuzzy Hash: AB712470E10219DFDB24CF99C98469EBBF1BF48314F25812EE919AB350DB34A946CF91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 5644 Parent PID: 3472 dhcpmon.exeCOMMON

Executed Functions

Function 016F0A30, Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd79c3f8bef559062c9c9cf2f5a2e78b2d7bd3549ea0e314a28d0e28c138b04e
Instruction ID: d31d5e09f56f6e27d1ef1e478d11bf8c63e4c539a9abfaab5bcfebbc61b9c583
Opcode Fuzzy Hash: fd79c3f8bef559062c9c9cf2f5a2e78b2d7bd3549ea0e314a28d0e28c138b04e
Instruction Fuzzy Hash: BC02B230B012459FCB51DF68C8909AEB7F2FF84304B15856DE606AB356DB31EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016F05B0, Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de8a206245d1860c08eb9c691e9a732f125aca8e86f4bcde6fcac07b4b133827
Instruction ID: cc97849783388ba1e68434dd8f414b9fbcd044a17f29d36070100d0062d19b2d
Opcode Fuzzy Hash: de8a206245d1860c08eb9c691e9a732f125aca8e86f4bcde6fcac07b4b133827
Instruction Fuzzy Hash: AED18B34705245CFD725DF28DC44A297BA3FF88344F1084A8EA428B366EB35EC51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 016F04B0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f218633b19acbcf43762f243904f46fd40666cc3b7ae46171e6eadb54a12b52b
Instruction ID: 2bf280af241dde971a76b20494164fd50ef4449873523eab321cacd41f2fd59b
Opcode Fuzzy Hash: f218633b19acbcf43762f243904f46fd40666cc3b7ae46171e6eadb54a12b52b
Instruction Fuzzy Hash: 27213A347152408FC789EB78D5589AD37E2AFC921931101A9E906CF772DB36DC4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 016F1098, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e67fac087a97e2df6a12d2f335b9fbc397e31a96b1b7f0f69107314f5b1d0ab
Instruction ID: 22ce279148467ede6e7ba338354cd2fa1d2bd3ce471a8b6606c682a2aaac2da7
Opcode Fuzzy Hash: 5e67fac087a97e2df6a12d2f335b9fbc397e31a96b1b7f0f69107314f5b1d0ab
Instruction Fuzzy Hash: 8311C831B041189FC754DBB4E8555EEBB75EF85244F1040BAD649DB750DF319D02CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 016F1028, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144e7d03ea6b685467137b14ee7a988cca515fa4fc4e9a57823a1c322872d226
Instruction ID: b2a4cda8a369efbc81e19b517cedcce796c1adf734e641a2d53d9a7b7c24d96d
Opcode Fuzzy Hash: 144e7d03ea6b685467137b14ee7a988cca515fa4fc4e9a57823a1c322872d226
Instruction Fuzzy Hash: B5F0A7327142285FC7686BB99C605BF63E9EFC5324711047EE51ADB744DE714C0643D4

Uniqueness

Uniqueness Score: -1.00%

Function 016F0468, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c21b935bc1464e597ec9f017a6ce9c14bbe1e2627bba8e0664865a74bc4086a
Instruction ID: ec4701121ac63bdfa65238b97e739f2b1db259b25cc49a4536204f87a4a408d3
Opcode Fuzzy Hash: 5c21b935bc1464e597ec9f017a6ce9c14bbe1e2627bba8e0664865a74bc4086a
Instruction Fuzzy Hash: F5E09233A04109AF9B14DFA9EC484DEBFFDEB88561B108067F009D2214EF3094608B80

Uniqueness

Uniqueness Score: -1.00%

Function 016F0457, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee496aa27f61d825c6f30e3368c02e6b9ce727d071ba019334bfed81940aff39
Instruction ID: 8de3eb2e1b0ee30153c0e07862f136401cbb3b212a8d0148561800e586d77078
Opcode Fuzzy Hash: ee496aa27f61d825c6f30e3368c02e6b9ce727d071ba019334bfed81940aff39
Instruction Fuzzy Hash: 2DF09B31A15249DFD755CFB9DC455DEBFF9EF45260B1081BBE809E3111E63055118711

Uniqueness

Uniqueness Score: -1.00%

Function 016F1145, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd3822ddece601d5ece284b2456f27d6f389ea5e74e84b44c9d8f9efb298ef1
Instruction ID: c2d4057320ab10b33103209754b6a70647cee26e19311aa5c69c8cb162ac0a5f
Opcode Fuzzy Hash: 8dd3822ddece601d5ece284b2456f27d6f389ea5e74e84b44c9d8f9efb298ef1
Instruction Fuzzy Hash: 32E02630B001449BC764E778F8446EE6395DB89258F00463CC806A7750CF280C854BA6

Uniqueness

Uniqueness Score: -1.00%

Function 016F0FE0, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73de2fdfd3b6d02c757b06c32ea982d7091dfb108d7ed37958ccdf138124812f
Instruction ID: 557c9e8c03993217f3a1491cf0a8da08ce705d92d9e23a1301c7bd04359ac784
Opcode Fuzzy Hash: 73de2fdfd3b6d02c757b06c32ea982d7091dfb108d7ed37958ccdf138124812f
Instruction Fuzzy Hash: 5EE08630605280CFD715CB78FC689947F70DF46255F1501DDE44697263D7694844CB11

Uniqueness

Uniqueness Score: -1.00%

Function 016F1095, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59cbd4aac01f2252206b3f67a0076e8df8e5170ad83e899b21107de48da0c46b
Instruction ID: ce115434a062120c71aeb6abd7953e62376dad9df2982ce52723c56c9d6be21f
Opcode Fuzzy Hash: 59cbd4aac01f2252206b3f67a0076e8df8e5170ad83e899b21107de48da0c46b
Instruction Fuzzy Hash: CDC01231A10114EB5B2497B87D064ED7B649A422A1714027DDD09E7240DB5449258792

Uniqueness

Uniqueness Score: -1.00%

Function 016F1190, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.271718407.00000000016F0000.00000040.00000001.sdmp, Offset: 016F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2304427afbb52c478640c34eda2422f971348831710542a3d5e2fc3efa46fd54
Instruction ID: eae7c7ec23ff889e824fadde3df6a54a18fafbae4b7290e736c7262111634186
Opcode Fuzzy Hash: 2304427afbb52c478640c34eda2422f971348831710542a3d5e2fc3efa46fd54
Instruction Fuzzy Hash: 2DC0120418A2C08FC3025B7A5C304883F305E862A834A81EEC0808A8A3E61D0429E729

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Scan_00059010189_ ref. 004118379411_ pdf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution